INDEPENDENT LEARNING PROJECT · FULL STACK · 2025 – PRESENT
FitFlexFlow Platform rebuild.fitflexflow.com ↗
End-to-end SaaS for online/offline fitness classes — subscription lifecycle, payments, live meetings and admin operations — designed and built solo as a learning project, but engineered to commercial standards: every concern from schema design and security to CI/CD and production operations is owned, automated and observable.
Architecture
A deliberately modular monolith: a single deployable Spring Boot app serving an Angular SSR frontend, with layered controller / service / repository / core design and feature-based packaging so modules can be extracted into microservices if the business scales. Configuration is modular per concern (persistence, security, payments, messaging, TLS, monitoring) with externalised, environment-specific secrets (dev / QA / prod) — keeping the codebase simple to operate while staying ready to scale.
Security
Secure-by-default design: Spring Security with OAuth2 client + resource server, JWT token issuance, and role-based access strategies (Admin / Instructor / Student) enforced via security filters. CORS is hardened, sensitive settings changes require admin re-authentication, and a dynamic maintenance mode — a filter-driven maintenance window with a user-facing notification page — can be toggled at runtime without redeploys, protecting both users and revenue during planned downtime.
Data
Oracle Autonomous DB over mutual TLS with a least-privilege model separating schema ownership from the runtime application account — so a compromised app credential cannot alter structure. The connection pool is tuned with fail-fast startup and leak detection for resilience under load, and versioned SQL migration scripts keep schema changes auditable and repeatable across environments.
Integrations
A pluggable payment-gateway abstraction (Razorpay, PayPal) with webhook-driven confirmation keeps revenue flows provider-agnostic. Social login (Google, Facebook) via OAuth2 reduces signup friction; Zoom Web SDK & Google Meet lifecycle management powers live classes; Google / Microsoft Graph handles calendar and email; and runtime-configurable SMTP (admin UI → application event → hot-reloaded mail sender with connection test before persist) lets operations change email providers without a redeploy.
Cloud & DevOps
Dockerised on OCI Compute behind Nginx (TLS termination, per-environment location configs, maintenance page) for a portable, reproducible runtime. A GitHub Actions deploy pipeline with traceable build signatures gives auditable releases, and scripted build-restart and secrets rollout keep deployments fast and consistent — the same operational discipline expected of a production SaaS.
Frontend performance
Performance treated as a feature: Angular SSR + prerendering for fast first paint and SEO, lazy-loaded feature routes and standalone components for smaller bundles, OnPush-style change detection to minimise render cycles, and asset caching with CDN-friendly static serving behind Nginx — keeping the experience fast for users on any device or network.
AI-native operations
The platform is operated through its own MCP tool layer: a logs server that pulls container logs and parses ERROR/WARN/FATAL lines into incidents with trace/span IDs, filtered by time window; a database server that is read-only in lower environments with a limited set of role-gated write operations permitted only up to QA — production data is never writable through an agent; and a Playwright server for E2E verification. AI assistants triage issues, inspect data and verify fixes in minutes — within the same least-privilege boundaries a human operator would have.
