Selfie Time Server

Overview

Main backend for the Selfie Time ecosystem: REST API for the React Native mobile app + kiosk clients, admin CMS, public website selfietime.id, and ~30 Go service modules sharing one DB. Hybrid PHP primary (Laravel 12, pinned 13.10.0 as 12.99.99) + Go secondary modular monolith behind a Chi-based API gateway. MySQL primary, Redis cache/queue, Laravel Horizon + Reverb websockets.

Admin panel migrated from Livewire/Blade to Inertia v2 + React 19 (Vite 8, Tailwind v4, Radix UI, TanStack Query/Table, Tiptap, Konva, FullCalendar, Chart.js, i18next, Zod, Shepherd onboarding). ~80 page controllers, 74 React page modules, 120 Eloquent models, 49 services, 35 queue jobs.

Key Features

Go API Gateway & Modular Monolith

• Chi + Cobra + Viper gateway: Admin API, SvelteKit Web UI, hot-reload, load balancing, retries, CORS, TLS, metrics, health probes
• ~30 Go service modules: decorations, outlets, products, catalog-products, popups, sliders, badges, kiosk, photo-auto-crop, user-items, booth-themes, employees, versions, vouchers, blogs, wallet/next-badge, fcm-token, surveys, instagram-detail, image-filters, print-media, layouts, galleries, screensavers, outlet-users, list-area, user-detail
• Go auth flow: RS256 JWT + Redis sessions + proxy headers; W3C traceparent + baggage propagation across gateway↔PHP
• DB connection pool scaling (500K users); MySQL→PostgreSQL compatibility config

Auth & Identity

• Passport OAuth2 + Sanctum tokens; Fortify + Jetstream; Socialite (Google/Facebook/Apple)
• Device OTP + rate limit; device fingerprint (pepper), trusted devices, login limit
• Impersonation; Super Admin role + role sync CLI; auth logs admin; email verification + password rotation

Outlets

• CRUD + nearby w/ distance + groups + rooms (moments scheduling)
• Categories, profit sharing, payment methods per outlet
• Employees + ratings + coordinator role
• Transaction monitoring: alerts, schedules, queue cache layer (Redis)

Products & Catalog

• Product CRUD (parent/child), cross-sell thematic, wide/high-angle, overlay/watermark types
• Print media CRUD + duplicate; Catalog CMS (features/locations/packets)
• Category positioning, inline management, live preview, ordering UI

Vouchers

• Full engine: conditions, transaction-count condition, daily-max usage, quota + reservation + atomic settlement trait
• Validation + eligibility service, cache + rehydrate bug fixes
• Birthday / holiday / on-demand / private-redeemable; buy voucher flow; redeem ads voucher; approval workflow
• Fraud detection: brute force, employee abuse, rapid cancels

Payments & Transactions

• Xendit (QR, atomic/idempotent callbacks, refund null handling) + Midtrans + custom payment gateway switch
• Refunds: requests + items + transactions + receipt upload; offline transactions + instant checkout
• Export (CSV/Excel filtered) + export jobs hub + Excel integration
• Transaction analytics page (charts, metrics, 30-min view); audit on delivery_status; status history + repair jobs
• Expiry (if unpaid); refund reversal (points); transaction photos + thumbnails + unlock locked originals

Moments (Photo Session Booking)

• Booking service + holds + expiry scheduling + room selection, hours 08-22, 30-min intervals
• Public API + Inertia payment page + voucher validation + instant checkout + gateway reconciliation
• Editor: unlock images, download locked originals, gallery download edited, thumbnails
• Linktree, layout/banner/header/navbar/footer; cross-sell bundle

Membership Points

• Expiry calculator + ledger + reconciliation + FIFO batch redemption + refund reversal
• Expiry reminder/diagnostics + manual restore + affiliate batch shadows + soft reset
• Admin lookup + user points history API + expiry summary on profile

Mini-Games & Promotions

• Spin Wheel: CRUD, public mode, prize title, terms, Spin Now
• Claw Game / Ocean Catcher: full suite — feature flag, permissions, eligibility, reward draw + grant, play service, controller, tests, admin CRUD, analytics, exports, quota metrics, alerts
• THR Catcher + THR Catcher New (session-based) + admin analytics; survey reward campaigns

Kiosk / Booth / Tablet Monitoring

• Booth monitoring: API + web + screenshots + Discord notifications (dedup + idle)
• Kiosk monitoring sync + version history + frame browser + photo auto-cropper (gfpgan_link)
• Tablet monitoring + version history; booth policy bulk update + themes; issues/categories
• Device limit anti-abuse
• Application installer: chunked upload + finalize, app version metadata, update policy + reminder push

Decorations & Layouts

• CRUD + bulk edit + usage stats + presigned URLs + CDN
• Categories ranking + filtering (outlet types, categories)
• Print media, layouts, layout media, layout backgrounds
• Migration to Go microservice (modular monolith, UUID schema rewrite)

Media & File Upload

• S3 / DigitalOcean Spaces disk switching (profile, decoration, order image)
• Chunked upload (application installer); watermark + scale (studio only); thumbnail generation
• Video faststart processing; photo quality download requests
• Self-Check Photobox (manual by date, external reference, cleanup); delete old order images (window option)

Gallery / Sliders / Popups / Screensavers

• Gallery CRUD + video preview; sliders (video toggle, banner pagination, instagram tag)
• Popups, screensavers (media_url by storage), tags (Spatie) for links
• Instagram feeds + auth + tag hide; YouTube feed

Blogs / SEO

• Blog CRUD + categories + analytics + image URL + notify new blog
• Sitemap (daily) + robots middleware

Notifications

• FCM tokens (Android/iOS + app version metadata)
• Discord (booth error, outlet idle, structured, event dedup); WhatsApp (group + single)
• SMTP dispatch service + SendGrid + dead-letter retry; email queue + resend limits (hourly reset, OTP 1 resend)
• 17 notification classes: transaction finished, birthday, voucher redeemed, badge upgrade, profile update, subscription reminder, point deposit/expire/reminder, repair health, waha health

Affiliate / Referral & Wallet

• Affiliate codes (owner_name, profile-completion logic) + program + voucher filter + reports + reward idempotency
• Wallet (bavix): transactions, transfers; badge points + next badge + point cashback rules (ignore for moments)

Approval Engine & Issue Tracking

• Workflows, requests, steps, actions, comments, execution logs + admin controllers
• Issues + issue categories

Self-Up Events & Campaigns

• Event registration + admin management + CSV export + proof file upload
• Campaign management: link registrations, docs, asset upload, preview, error handling, permissions menu
• Sena event forms (June / May / April 2026)

Surveys / QMD Forms

• Survey campaign + submissions + reward claims + export
• QMD forms: question details + responses; Excel integration

Observability (OTel)

• keepsuit/laravel-opentelemetry + OpenTelemetry SDK + Go SDK; cross-language tracing via W3C tracecontext
• DB auto-instrumentation (SQL, transactions, Eloquent events); payload + header tracing with sanitization
• Hierarchical controller + business spans; multi-exporter fan-out
• Tempo + Loki + Prometheus + Alloy + Promtail docker-compose (Grafana LGTM)
• Business metrics: voucher fraud, employee action, transaction, S3 validation counter

Fraud Detection & Security

• Voucher brute force / employee abuse / rapid cancels + 9 Prometheus alert rules
• Device fingerprint pepper + login limit; rate limiting (OTP, S3 validation logs, throttle guard)
• Debug routes local-only guard; dependabot resolution (22/24 vulnerabilities)
• DB-safety checker: destructive migration guard with allowlist (composer check:db-safety)

Admin CMS (Inertia + React)

• Migrated from Livewire/Blade to Inertia v2 + React 19
• ~80 page controllers / 74 React modules; AdminNavigationService; Super Admin + role admin
• Reusable primitives: AdminPage, AdminSurface, AdminFilterBar, SearchableSelect, AdminDataTable, DateRangePickerInput, useApiQuery, useApiMutation, AssetUploadField
• Export jobs hub, sensitive value audit + audit events, Excel export, QMD admin roles, static views analytics (compare page)

Infrastructure / DevOps

• Docker: base, k8s, dev, prod, monitoring, replication (6 Dockerfiles + 5 docker-compose)
• Kubernetes manifests + canary deployment + GitOps + metric analysis scripts
• CI: GitHub Actions + GitLab CI + SonarQube + Dusk e2e + k6 load/spike/stress tests
• MkDocs TechDocs (Backstage catalog-info); cache layer standardization (ApiCacheInvalidationService); Reverb websockets
• PostHog feature flag routing system

Tech Stack

• Laravel 12 + PHP 8.2 (primary); Go 1.26 (secondary — gateway + modular monolith)
• Inertia v2 + React 19 admin CMS (Vite 8, Tailwind v4, Radix UI, TanStack Query/Table, Tiptap, Konva, FullCalendar, Chart.js)
• MySQL primary (PostgreSQL compatibility config); Redis cache + queue; Laravel Horizon + Reverb
• Passport (OAuth2), Sanctum, Fortify/Jetstream, Socialite; Spatie (Permission/Media/Tags/Settings/Auditing/Sitemap/Robots/Cookie-consent/Data)
• bavix wallet; maatwebsite/excel; phpoffice/phpword; Intervention Image; league/flysystem-aws-s3-v3 (S3 + DO Spaces)
• Xendit + Midtrans + custom payment gateway switch
• OpenTelemetry (keepsuit/laravel-opentelemetry + PHP/Go SDK); Prometheus + Grafana LGTM stack
• Docker (6 Dockerfiles) + Kubernetes + canary deploy + GitOps; GitHub Actions + GitLab CI + SonarQube + k6 load tests
• Livewire v3 retained only for legacy login/OTP slice; l5-swagger; bacon QR / simple-qrcode; laravisit; ZipStream

Role

Fullstack Developer at PT Intinya Technology. Maintain and extend the Laravel/Go backend, build admin dashboards, implement OpenTelemetry end-to-end across PHP and Go, and ensure compatibility between mobile app, kiosk clients, and kiosk server. Own the Go gateway modular monolith migration.