Overview
Full-stack e-commerce platform built from scratch as a monorepo with two applications: the e-commerce store and a companion AI assistant. The focus is clean architecture, long-term maintainability, and production-grade quality throughout - real payment integrations, Redis caching, Elasticsearch search, queue-based async processing, a complete QA + security pipeline, and comprehensive documentation for every layer of the system.
Architecture
Hexagonal Architecture (Ports & Adapters) with Domain-Driven Design, CQRS, and Event-Driven design. Business logic is fully isolated from infrastructure - swapping Stripe, the mailer, or the database requires zero changes to the domain. The monorepo is deployed to a single Kubernetes (k3s) cluster on Oracle Cloud (ARM VM, provisioned via Terraform + Ansible) and managed entirely via ArgoCD GitOps - the cluster always reflects what is in the repository. Part of a two-app monorepo - see also the companion LevelUp Store AI Assistant.
Key Features
- Product catalog - categories, types, subtypes, filters, sorting, full-text Elasticsearch search with faceted filtering and relevance tuning
- Cart & checkout - real-time stock validation, Stripe card payments, cash-on-delivery, unique order codes
- PDF invoices - generated asynchronously via wkhtmltopdf, dispatched by the order event queue
- Admin panel - dashboard analytics (ApexCharts), full CRUD for products, orders, users, and reviews
- Auth & security - JWT access/refresh tokens, email verification, Cloudflare Turnstile, password reset, RBAC, rate limiting on all auth endpoints
- API documentation - Swagger/OpenAPI
- Wishlist & reviews - like/dislike reactions, live stock and review updates pushed to the browser via Mercure SSE without polling
- Async processing - RabbitMQ with Symfony Messenger handles order events, email dispatch, invoice generation, and AI requests, all decoupled from the HTTP request cycle; Outbox Pattern ensures atomic DB writes and guaranteed message delivery on RabbitMQ failure
- Object storage - MinIO (S3-compatible) for product images and generated PDFs, pluggable via Flysystem
- Observability - distributed tracing with OpenTelemetry + Tempo, structured logs with Loki, Prometheus metrics + Grafana dashboards, AlertManager notifications, Blackbox Exporter endpoint health checks, Grafana Alloy as collector, Sentry error tracking
- Secrets management - HashiCorp Vault with External Secrets Operator for runtime secret injection; Sealed Secrets for encrypted secrets committed to git
- Ingress security - Coraza WAF (Traefik plugin) with OWASP Core Rule Set; Cloudflare proxied DNS for DDoS mitigation and WAF at the edge
- Runtime security - Falco threat detection, Kyverno policy enforcement, Reloader for zero-downtime config reloads
- Supply chain security - multi-arch Docker images (amd64 + arm64), cosign keyless signing via Sigstore, SBOM generation with Syft + GitHub Attestation, pinned GitHub Actions digest references, OSSF Scorecard
- CI/CD pipeline - GitHub Actions automated deploy on push to main; Jenkins manual pipeline with staging deploy + approval gate before production promotion; Renovate for automated dependency update PRs across Composer, pnpm, Docker, and Helm
- QA - PHPStan level 10+, PHPUnit (unit, integration, feature), PHPMD, PHPCPD, Rector, PHP CS Fixer on the backend; Vitest (unit, integration, functional), Playwright, ESLint, and Stylelint on the frontend - 100% coverage on all tested files
- AI Assistant - companion app in the same monorepo: LevelUp Store AI Assistant
