Join our team of writers
Hassan MohammadzadehHassan Mohammadzadeh
Back to projects

LivePersepolis — Official Digital Platform of Persepolis F.C.

View demo
My role: System architecture design and full-stack implementation (Next.js frontend, Django backend)Client: Persepolis Cultural & Sports Club
Next.jsReactTypeScriptPythonDjangoDjango REST FrameworkPostgreSQLRedisCeleryDockerNginxJWT / OAuth2
LivePersepolis — Official Digital Platform of Persepolis F.C.

Overview

LivePersepolis is the official digital platform of Persepolis F.C. — the most popular and most decorated football club in Iran, with millions of fans across the country and the wider region. This is far more than a news site: it's the club's official digital backbone, unifying live match coverage, breaking news, the official store, ticket sales, and a fan membership hub under one platform — all while absorbing explosive traffic spikes on matchdays and major transfer news. A system at this scale demanded a genuinely principled, secure, and scalable architecture, not a conventional website build.

Key Features

  • A Live Match Center delivering real-time scores, stats, and match events over a live connection
  • Round-the-clock news coverage with bilingual (Persian/English) content management, photo galleries, and video
  • A fan club system with dedicated profiles, loyalty tiers, and a points/rewards program
  • An official online store with inventory management, cart, and a secure payment gateway
  • An online match-ticketing system with real-time capacity control and transactional locking to prevent double-booking (race conditions) during high-pressure presale windows
  • Push and SMS notifications for breaking news and match results
  • A dedicated content management panel for the club's media team, built on a customized Django Admin with segregated access levels

Technical Architecture & Security

The architecture is fully decoupled: the frontend is built with Next.js using hybrid SSR/ISR rendering to guarantee strong SEO for news content while keeping pages extremely fast for millions of visitors; the backend is an independent Python/Django REST API, so the frontend and backend scale entirely independently of each other. PostgreSQL is the primary database, with Redis handling caching, session management, and message queuing. Heavy, time-consuming work — bulk notification delivery, image processing, report generation — runs asynchronously in the background via Celery, so the user experience never slows down. The entire service runs in isolated Docker containers behind Nginx as a reverse proxy and load balancer, with CDN edge caching for static assets and media, keeping the platform stable even during matchday traffic peaks.

Given the exposure of an official platform at this scale, security is enforced at every layer: JWT/OAuth2-based authentication, rate limiting on sensitive endpoints — especially ticketing — to defend against bots and abuse attempts, thorough input validation and sanitization against XSS/SQLi/CSRF following Django and DRF standards plus additional hardening layers, HTTPS with HSTS enforced everywhere, encryption of sensitive data at rest, and precise role-based access control (RBAC) separating admin, media team, and store/ticketing operator permissions — all backed by full activity logging for traceability and security auditing.

My Role

I was responsible for the overall system architecture (both frontend and backend), implementing the UI in Next.js, building out the Django APIs, setting up the caching and async-processing infrastructure with Redis and Celery, and hardening security across every layer of the application — with particular focus on keeping the system stable through matchday and ticket-presale traffic surges.