Case study
A multi-area personal tracking application I designed, built and operate in production. Everything below is live code: the screenshots are taken from the running application.
Accounts, transactions, categories, payees, recurring items and reconciliation — with QIF import/export and running balances.
Spending by category, cash-flow over time, net worth and asset values — rendered as fast server-side pages with charts.
Itineraries with days, lodging, activities, meals and transport; geocoded stops, travel-time conflict checks, maps and a printable/PDF itinerary.
Exercise logging, meals and food database, health notes and a dashboard that pulls it together.
Applications, follow-ups, documents and résumés; AI-generated job synopses and fit analysis; reminder emails; a Sankey view of the pipeline.
Simple lists and items with due dates — the kind of small feature that still gets tests, authorization and admin support.
Stateless JWT authentication with MFA, a registry-driven admin UI, strict CSP, rate limiting, GDPR export/delete, metrics, and continuous deployment.
Under the hood
PHPUnit suites at three levels; every test runs in a rolled-back database transaction; a coverage gate fails the build below 90%. Money-critical arithmetic is spot-checked with mutation testing.
GitHub Actions runs audit + tests on every push; a green push to main deploys automatically with Deployer: migrations before the symlink flip, smoke test after, rollback on failure.
Stateless JWT auth with a rotating key ring and MFA; object-level authorization via voters; per-response CSP nonces; Cloudflare Turnstile on registration and suspicious logins; admin actions audited.
Separate app, database, cache, vault and monitoring hosts on a private network; nightly dumps plus binlog point-in-time restore; Prometheus/Grafana dashboards and alerts; secrets rendered from Vault at deploy time.
Visit KeepingTrackOf.com.
Most of what you see here started as a one-page brief.
