Teardown: Project OSEDUI.
Architecting absolute data isolation and zero-latency routing for a global EdTech ecosystem. We bypassed fragile legacy LMS platforms to engineer a hyper-secure, multi-tenant SaaS utilizing Next.js, PostgreSQL, and heavy n8n orchestration.
Legacy Architecture Crashes at Scale.
Before iHexe, the client's infrastructure was a monolithic nightmare. When multiple schools attempted to run concurrent video streams and process tuition billing during enrollment week, the single shared database locked up. Worse, their legacy codebase lacked strict schema isolation, meaning a single miswritten API query could expose sensitive student records across different school districts. They needed a fortress, not an app.
Extracted Slug: "boston"
x-tenant-schema: schema_tenant_boston
Scope: Boston District Academy
The iHexe Multi-Tenant Protocol
Next.js Edge Routing & Subdomain Middleware
We eliminated manual tenant switching. We deployed custom Next.js middleware at the edge to instantly parse incoming requests (e.g., boston.osedui.com). The edge server securely identifies the tenant ID in milliseconds and routes the user to their mathematically isolated environment before the DOM even begins to render.
PostgreSQL Schema-Level Isolation
Shared databases are a liability. We engineered a strict Schema-per-Tenant architecture in PostgreSQL. Even though all schools operate on the same core codebase, their data lives in completely separate, encrypted database schemas. A breach in one tenant cannot physically cascade to another.
n8n Global Orchestration Pipelines
Multi-tenant systems require global synchronization. We deployed robust n8n webhook pipelines to handle the heavy background processing. When a global curriculum update is pushed, or recurring tuition is billed, our n8n nodes autonomously orchestrate the logic across all 150+ tenant schemas simultaneously without blocking the main Node.js event loop.
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';
import { getTenantBySubdomain } from '@/lib/tenant-resolver';
export async function middleware(request: NextRequest) {
const hostname = request.headers.get('host') || '';
const url = request.nextUrl.clone();
// Extract subdomain (e.g. "boston" from "boston.osedui.com")
const subdomain = hostname.split('.')[0];
const isCustomDomain = !hostname.includes('osedui.com');
if (!subdomain || subdomain === 'www' || subdomain === 'app') {
return NextResponse.next();
}
// 1. Instant L1 Redis Lookup for Tenant Mapping (< 1.8ms)
const tenant = await getTenantBySubdomain(subdomain, isCustomDomain);
if (!tenant) {
url.pathname = '/404-tenant-not-found';
return NextResponse.rewrite(url);
} // 2. Inject Mathematically Isolated Headers before DOM Render
const requestHeaders = new Headers(request.headers);
requestHeaders.set('x-tenant-id', tenant.id);
requestHeaders.set('x-tenant-schema', tenant.schemaName);
requestHeaders.set('x-tenant-role-matrix', tenant.roleMatrixHash); // 3. Rewrite request internally to isolated tenant layout
return NextResponse.next({
request: {
headers: requestHeaders,
},
});
}Ready to Replace Monolithic Vulnerabilities in Your Enterprise?
Review your architecture with iHexe Principal Engineers. We eliminate data leaks, optimize edge routing, and scale backend databases to handle 100K+ concurrent requests.