#access-control

The personnel information system of the City Government of South Tangerang: employees keep their own records and follow their services, administrators work on exactly their part of the organisation, and every rule comes from the regulation that sets it. Led and built by me since 2023.

The Vue browser application of a civil-service personnel system: a self-service portal where employees keep their records and propose changes, and administration of a versioned organisation chart, reference data and accounts — built from a few shared definitions, not a page per record.

The Laravel core of a civil-service personnel system: employee records and career histories, self-service proposals with review, salary-step, promotion and retirement decisions, rules taken from regulations, a versioned organisation chart, and access scoped down to a single unit.

Administrators of a city government's personnel system must each touch only their part of it: everything, one agency, or one unit. I made the scope data — a grant is user, role and scope — checked by one rule, requested and approved by different people, and expiring on its own.

Templates come from real stacks, and copies quietly carry their data, keys, open databases and root-owned paths. My database, object storage and application generators leave the old data, keys and access behind, and read each application's facts from the application itself.

Every project gets its own OpenTelemetry Collector, Elasticsearch and Kibana from one command, showing data on dashboards from the first start, by owning the data directory, starting services in the order they need, and keeping the official mappings on one node.

Opening a broker to browsers and devices on the internet is less about encryption than identity. Each entrance now accepts one kind of credential, every token is bound to its own name and addressed to this broker, and TLS ends in nginx.

A laptop and a borrowed Colab GPU talked through a public MQTT broker that anyone could read. Giving that channel an identity took an afternoon on the broker and eight obstacles in the clients — mostly safeguards that were right for the old setup and wrong for the new one.