August 18, 2026
Excalidraw-style collaborative whiteboard with real-time shape sync over WebSockets, Bun-native backends, session-based auth, and automated CI/CD deployment.
Type: Self-initiated personal project to a full-featured collaborative whiteboard. Live at codraw.nerdev.in · Source github.com/nerdev-co/codraw
Whiteboards are where ideas actually get shaped to but the tools are either simple toys that lose your work, or locked into a vendor's cloud. Excalidraw drew beautifully but was client-side only: no sync, no accounts, no saving. Miro-class tools were powerful but closed and pricey.
The goal was a whiteboard that behaves like a real product:
Designed and built the product end-to-end as a solo engineer, owning the product, architecture, frontend canvas engine, backend services, realtime synchronization, data model, and deployment.
The system was structured as a distributed, realtime application spanning:
This wasn't a demo wired to a socket. It involved designing and operating the architecture needed to make a realtime, multi-user drawing product dependable in production: from canvas math to deployment.
Broadcasting entire canvases doesn't scale and two people editing the same shape can clobber each other. CoDraw sends only shape diffs over WebSocket, and every save carries a version check to if someone else changed the canvas underneath you, the server says "conflict" instead of silently overwriting. The result: multi-user drawing that feels instant and never loses a stroke.
Rough.js's hand-drawn look is CPU-heavy to the wrong approach crawls at 60fps. The canvas redraws only the changed regions (dirty-rect rendering) and layers static content so interactions don't recompute the whole scene. Hundreds of shapes stay responsive, and the sketchy aesthetic is preserved.
Stateless JWT sessions can't be killed before they expire to a logged-out user stays logged in. CoDraw uses server-side sessions with httpOnly cookies: log out, and the session is destroyed server-side. The WebSocket connection re-validates with rotating short-lived tokens, so a stolen token can't outlive its five-minute window.
Connections die to sleep, elevators, tab switches. The canvas stays fully usable while disconnected, then reconciles with the authoritative server state on reconnect instead of replaying a fragile log of missed messages. Reattachment is a clean "resume," not a gamble.
| Metric | Value |
|---|---|
| Development period | Jan 2025 → present (production since Aug 2026) |
| Concurrent users per room | 50-plus |
| Sync latency | Under 50ms |
| Drawing tools | Sixteen |
| Export formats | PNG · SVG · JSON |
| Collaboration | Real-time room sync (shapes, cursors, chat) |
| Deployment | 1× EC2 (t3.small) · Nginx · PM2 · Neon Postgres · CI/CD |
| Production incidents | Four root-caused and documented |
| Commits | Four-seven-four |
Live and product-complete: realtime collaboration, persistence, auth, export, and automated deployment to with each of the four production incidents fixed at the architectural level and written up rather than patched. Areas still evolving: automated test coverage and a deeper accessibility audit of canvas controls.
Project Links: