HanDev Internal Platform

Challenge

The studio has 20+ production services across projects. Without a unified platform: separate auth per service, fragmented monitoring, tests scattered across CI pipelines, each service with its own navigation. We decided to build a platform that solves this once and for all.

What We Did

• 4 services under *.handev.org with unified SSO via HttpOnly cookie (Domain=.handev.org).
• Cookie-SSO + JWT with public JWKS: Identity signs RS256, others verify via JWKS. 15-min access + 30-day refresh with triple renewal.
• Service-access gate: even a valid JWT is rejected if payload.services does not contain the current service key.
• Global roles (admin/devops/qa/developer/customer/manager/marketing) stored in Identity, mapped to internal roles per service.
• Shared PostgreSQL 18 on DigitalOcean: one database per service.
• Shared npm packages @handev/platform-ui, @handev/platform-auth, @handev/tailwind-preset — auto-versioning MAJOR.MINOR.PIPELINE_IID.
• Unified layout: PlatformProvider + PlatformLayout with shared header, service-switcher, user-menu and sidebar.
• Deploy via GitLab CI → Docker registry → Portainer webhook. Traefik reverse proxy with automatic SSL.

Result

• Single sign-on for all internal tools: one login — Identity / UpTime / QA Orchestrator.
• 4 production services with unified UI/UX, shared stack and PostgreSQL.
• Platform used for testing and monitoring all client products.