GEM Platform
Platform internal PT Guna Era Manufaktura: lima aplikasi bisnis yang saling terhubung, satu SSO untuk semuanya, layanan email berantrean, dan backup otomatis, semuanya di satu server. Dibangun tim dua orang; saya mengelola seluruh infrastrukturnya dan memutuskan perubahan mana yang layak naik ke produksi.PT Guna Era Manufaktura's internal platform: five connected business apps, one sign-on for all of them, a queued mail service, and automated backups, all on a single server. Built by a two-person team; I run the entire infrastructure and decide which changes are fit for production.
ArsitekturArchitecture
- Produksi punya satu pintu: setiap perubahan dicoba di mode dev dan di-review dulu sebelum diputuskan layak naik ke produksi, lalu di-deploy lewat Jenkins.Production has one gate: every change is tried in dev mode and reviewed before it is cleared for production, then Jenkins deploys it.
- Setiap aplikasi adalah pasangan frontend React dan backend NestJS + Prisma dengan database PostgreSQL sendiri, dijalankan lewat Docker Compose.Each app is a React frontend and a NestJS + Prisma backend with its own PostgreSQL database, run with Docker Compose.
- Login terpusat di SSO: aplikasi hanya menukar authorization code dan memeriksa role, tanpa menyimpan password sendiri.Sign-in lives in the SSO: apps only exchange an authorization code and check roles, never storing passwords themselves.
- Container hanya mendengarkan di loopback; Nginx di host menjadi satu-satunya pintu masuk, dengan TLS dan subdomain per aplikasi.Containers listen on loopback only; Nginx on the host is the single way in, with TLS and a subdomain per app.
- Aplikasi bertukar data lewat endpoint server-to-server dengan header shared secret, bukan lewat database bersama.Apps exchange data through server-to-server endpoints with a shared-secret header rather than a shared database.
- Mode dev memakai Compose dan database terpisah dari produksi, dinyalakan dari panel dan dimatikan otomatis setiap hari.Dev mode uses Compose files and databases separate from production, switched on from a panel and shut down automatically every day.
Yang bisa dilakukanWhat it does
GEM SSO
OAuth 2.0 authorization code flow untuk semua aplikasi, login Microsoft yang dibatasi domain perusahaan, sesi HttpOnly, dan role per aplikasi yang diatur admin.An OAuth 2.0 authorization-code flow for every app, Microsoft sign-in limited to the company domain, HttpOnly sessions, and per-app roles managed by admins.
Warehouse Management (WM)
Alur Purchase Order, inbound, QC incoming, outbound, sampai saldo stok, dengan import PO dari Excel dan bukti foto tersimpan di S3.Purchase order, inbound, incoming QC, outbound, and stock balance flows, with Excel PO import and photo evidence stored in S3.
Sales Management (SM)
Customer, quotation, sales order, pipeline, dan aktivitas mingguan; quotation yang menang menjadi dasar project di PM.Customers, quotations, sales orders, pipeline, and weekly activities; a won quotation becomes the basis for a project in PM.
Project Management (PM)
Project dan task per role, terhubung ke SM, ENG, dan WM lewat API antar-aplikasi yang dilindungi shared secret.Projects and role-based tasks, linked to SM, ENG, and WM through app-to-app APIs guarded by a shared secret.
Engineering (ENG)
Document control untuk drawing dan spesifikasi: revisi tidak pernah menimpa revisi lama, dan setiap file disimpan bersama hash SHA-256.Document control for drawings and specs: a revision never overwrites the last one, and every file is stored with its SHA-256 hash.
GEM One
Kalender layanan umum untuk pemesanan driver, ruangan, dan maintenance, dengan approval sesuai role.A general services calendar for booking drivers, rooms, and maintenance, with role-based approvals.
GEM Mailer
Layanan email asinkron dengan antrean BullMQ di Redis dan failover provider Brevo, Resend, lalu Postfix sendiri dengan DKIM.An asynchronous mail service on a BullMQ queue in Redis, failing over from Brevo to Resend to a self-hosted Postfix with DKIM.
Backup & cron jobBackups & cron jobs
Backup harian PostgreSQL dan MinIO ke Cloudflare R2 dengan checksum SHA-256, kompresi gambar, dan pembersihan file lama.Daily PostgreSQL and MinIO backups to Cloudflare R2 with SHA-256 checksums, image compression, and cleanup of stale files.
Stack
- Frontend
- React · TypeScript · Vite · Tailwind CSS
- Backend
- NestJS · Prisma · PostgreSQL · Redis · BullMQ
- Infra
- Docker Compose · Nginx · Jenkins · MinIO · Postfix · Cloudflare R2