Tall3 — Multi-Tenant SaaS for Car Dealerships

Overview

Tall3 is a multi-tenant SaaS platform for car dealerships and showrooms in Saudi Arabia, each with its own storefront on the platform. The backend is a Laravel application using stancl/tenancy for multi-tenancy, paired with a Next.js frontend.

I worked on Tall3 as a freelance backend contractor for about two months, on an existing production platform I didn’t build from scratch. My work covered REST API development, tenant-specific features, a self-hosted WhatsApp integration, and the backend for letting tenants connect their own custom domain to their storefront.

Key Engineering Contributions

• Tenant custom domains (Cloudflare for SaaS): Designed and built the backend for connecting a tenant’s own domain to their storefront — coordinating a domain purchase through the N-Genius payment gateway, Cloudflare’s Registrar and SSL for SaaS products, asynchronous status polling, and dynamic per-domain CORS. Covered in detail below.
• WhatsApp integration (self-hosted, Evolution API): After evaluating the official WhatsApp Business API and ruling it out, built WhatsApp connectivity on a self-hosted gateway — QR-based account connection, multi-number session management, tenant-specific transactional notifications (order confirmations, OTP), and a marketing campaign engine with CSV recipient import, templated messages, paced sending, and live progress/failure tracking.
• Platform backend work: Developed and maintained REST APIs and tenant-specific features on the existing codebase, integrated the Gemini API for AI-assisted functionality, built tooling to help new tenants migrate data from competing platforms, and worked on Redis caching and performance fixes.

Tenant Custom Domains

The most involved piece of backend work on Tall3: letting a tenant buy a real domain and have it instantly serve their existing storefront — theirbrand.com showing the same site as their normal tall3.com/cars/{tenantId} page, with a working SSL certificate and no manual DNS work by anyone.

The flow coordinates a payment gateway, two separate Cloudflare products, and both the Laravel backend and the Next.js frontend:

1. A tenant searches for and picks a domain; the backend creates a checkout session with N-Genius, the platform’s payment gateway, and the tenant is redirected to a hosted checkout page to pay.
2. Once payment is confirmed, the backend registers the domain through Cloudflare’s Registrar API — an async operation, so a scheduled job polls it to completion.
3. Registration auto-creates a new DNS zone; the backend injects the records pointing back at Tall3’s infrastructure.
4. The domain is then registered as a Cloudflare “custom hostname” on Tall3’s own zone — the step that actually gets it a certificate, also async and polled.
5. Once active, traffic for the new domain terminates at Cloudflare’s edge and forwards to a shared fallback origin running the Next.js frontend — a server with no domain-specific configuration of its own.
6. Since the platform’s existing multi-tenancy setup only resolves its own subdomains, the frontend calls a dedicated backend endpoint to map the unfamiliar hostname to a tenant, then renders that tenant’s storefront.
7. Because that storefront now runs on a domain outside Tall3’s own, the backend dynamically allows CORS for it — checked against the table of active, paid domains rather than a wildcard.

Neither of Cloudflare’s async endpoints pushes a webhook, so nothing notifies the backend when a registration or certificate finishes — a background job polls both every minute, with capped exponential backoff, and writes each result into a tenant_domains.status state machine (pending_payment → registering → registered_pending_dns → configuring_dns → provisioning_ssl → active, with failed/action_required branches). It picks up correctly from wherever a domain left off even if the app restarted since the last check.

Technical Stack

Live Platform

Explore the platform: tall3.com

Tall3 is a proprietary platform I contributed to as a freelancer. This case study describes my contributions without exposing confidential code, credentials, or tenant data.