Bongani Mbigi
← Work

Helvoq

Shared equipment checkout I designed, built, and still operate — who has the gear, when it is due, and what condition it came back in.

Helvoq
helvoq.comAppDocsKioskLabelsDevelopers

What I owned

The Spring Modulith backend, a dedicated authorization server, the React staff and borrower apps, Kotlin Multiplatform mobile and kiosk clients, Next.js marketing, docs, and labels, Kubernetes production, billing, and identity. There is no separate product, design, or platform team — the checkout flow and the cluster are the same job. That is the systems work I want to keep doing at staff scope.

Systems

I collapsed the old Spring Cloud mesh into a modular monolith so domain boundaries stay compile-checked without a network hop per service. The authorization server stays a separate process. Workspaces isolate tenants. Institution plans add campus identity. Production is Kubernetes with traces you can actually query.

Backend

Java 21 Spring Modulith in one process: closed modules for assets, borrowers, checkouts, reservations, audit, and GenAI, talking through producer-owned APIs. Modulith verify() and ArchUnit hold the boundaries. PostgreSQL with a single Flyway history; S3-compatible storage for condition photos. Public contracts in OpenAPI at docs.helvoq.com.

Auth & tenancy

A separate authorization server issues OAuth tokens and owns login, Stripe, SSO, and SCIM. Workspaces isolate tenants with RBAC. Institution plans add OIDC and SCIM 2.0 — Entra, Okta, or Google Workspace, with group-to-role mapping. Auth never calls back into the app.

Production

DigitalOcean Kubernetes with ingress by hostname (app, auth, docs, kiosk, labels, developer, apex). OpenTelemetry traces and logs to Honeycomb; Stripe for billing. GitHub Actions publishes images and rolls the cluster.

Clients

React + Cloudscape staff desk and borrower portal, Next.js marketing, docs, and labels, a Kotlin Multiplatform mobile app (Compose Android, UIKit iOS), and a Compose Multiplatform kiosk on desktop, Wasm, Android, and iOS.

Product

Built for media programs, labs, and AV cages that still run checkout on a spreadsheet or a Slack chase. Each item gets a QR profile. Staff check gear out from a desk app. Borrowers request and scan in a simpler portal. A kiosk can sit at the cage. Condition notes stay on the asset.

QR checkout

Print labels, scan a phone or HID scanner, and see live status, borrower, and due date. A free generator at labels.helvoq.com works without an account.

Kits & inventory

Cameras, kits, consumables, accessories, and locations — modeled like a gear room, not a generic CMDB. Import the spreadsheet and keep going.

Self-checkout kiosk

Library card + PIN at an unattended desk, with branded idle and the same workspace as staff loans. Live at kiosk.helvoq.com.

Reservations

Borrowers request a window; staff approve, tweak, or reject before two people claim the same kit.

Service history

Condition photos and repair logs stay on the asset so the next person is not surprised.

Workspaces

Each media program, lab, or AV cage keeps its own inventory, invites, and roles under one organization.

Campus identity

OIDC SSO and SCIM 2.0 on Institution plans — Entra, Okta, or Google Workspace, with directory groups mapped to staff roles.

Assistant

A tenant-scoped gear-room assistant for overdue loans, availability, and warranty or end-of-life reports — Spring AI over the same module APIs.

Surfaces

One cluster, hostname routing, seven public hosts.

Try it

Create a workspace, import inventory, print QR labels, and run a checkout at helvoq.com. Developer docs and the API reference are at docs.helvoq.com. Labels without an account are at labels.helvoq.com.