where_woof/docs/RESUME-HIGHLIGHTS.md

Where Woof — Project Highlights (resume-ready)

A production return-item tag platform built end-to-end on a home-lab stack, from spec to live deployment.

What it is

A SaaS-style product: physical QR/NFC tags for pets/luggage; a finder scans → sees return details → the owner is alerted by SMS with the finder's location. Includes a full admin dashboard for users, tags, products and orders.

What I built (the pipeline)

1. Spec-driven development — OpenSpec: every feature went through proposal → design → specs (testable requirements) → tasks, validated, and tracked through the whole project.
2. Public web app (Go) — "GOAT" stack: Go stdlib + HTMX + Alpine.js + Tailwind + Postgres. Auth, tag registry (anti-scam), scan flow with geolocation, location-aware SMS throttling, browser-fingerprint anti-spam, photo uploads.
3. Admin app (Laravel + Filament) — CRUD for users/tags/products/orders, dashboard stats, admin auth gating — against the same shared Postgres.
4. Real SMS integration — SMSGlobal HTTP API (verified sender), with a swappable sender abstraction and a log-mode fake for testing.
5. Deployment — Go binary as a systemd service, Laravel in Docker, Caddy reverse proxy with automatic TLS, DNS migration off legacy hosting, internal DNS (Pi-hole), firewall management on NixOS.
6. AI-assisted engineering workflow — used the pi coding agent with subagent delegation (database/coder/review agents), plan review tooling, memory/runbooks, and regression test suites (53 HTTP-level checks).

Stack highlights

Go 1.26 · HTMX · Alpine.js · Tailwind · PostgreSQL 16 · sqlc (type-safe SQL) · Laravel 13 · Filament v3 · Docker · NixOS · systemd · Caddy · Gitea · SMSGlobal API · OpenSpec · pi/agent tooling

Things I'm proud of / learned

• Decrypted a legacy AES-256-ECB product-ID scheme (100 encrypted sequential IDs recovered and re-seeded as a tamper-proof registry).
• Debugged and fixed production-only issues: Filament's 403-after-login (model must implement FilamentUser), mixed-content asset blocking behind a reverse proxy, and a Caddy config crash from duplicate site blocks.
• Rebuilt my own 2014-era product design (its comments anticipated distance throttling and fingerprint anti-spam) with modern tooling.

Where it runs

Live on where-woof.com and admin.where-woof.com — home-lab infra: desktop (.27, dev) → server (.13, prod) → Caddy box (.35), one shared Postgres.