Enterprise platform/Bling Square Events/2024live
Sarvagun ERP
Six departments behind one permission layer: events, CRM, vendors, finance, HR and payroll. It replaced spreadsheets and WhatsApp threads.
RoleWeb developer to team lead: build, infrastructure, incident responseTimelineFeb 2024 – Aug 2026
- Client
- Bling Square Events
- Live since
- 2024
- Modules
- 6
- Avg response
- 236ms
Six modules, one permission layer. The sidebar is generated from a user's role rather than hidden with CSS, so routes they are not entitled to do not exist for them.
The brief
An events company running on spreadsheets, WhatsApp messages and disconnected tools. Employee records were manual, event planning was untrackable, sales and expenses lived in separate sheets, and management had no unified view of any of it.
What was actually hard
The difficulty was never any single module. It was that six of them had to ship while the schema was still moving underneath them, and every department needed to see a different slice of the same data. Get the permission layer wrong and either people see payroll they should not, or they are locked out of their own work and quietly go back to the spreadsheet.
Decisions
What I decided,
and why.
- 01
Modular from the first migration
Event management, CRM, vendors, finance, HR and payroll were built as distinct modules with their own boundaries, so adding the sixth did not require touching the first. Schema changes went through Django migrations rather than being applied by hand.
- 02
Role-based access drives the interface itself
The sidebar is generated from permissions, not hard-coded and hidden with CSS. A user cannot navigate to something they are not entitled to see, because for them the route does not exist.
- 03
A deployment pipeline, not a deployment ritual
Releases went out as hand-uploaded zip files. I replaced that with a GitHub Actions pipeline and moved the whole thing off managed hosting onto a self-managed Ubuntu server — Several production applications now run on one 2GB box at 236ms average response.
- 04
Closed a live security hole in 48 hours
The production server's real IP was exposed. DNS went behind Cloudflare for masking, and the box was hardened with UFW, Fail2Ban and PAM-secured SSH. Done inside two days with zero downtime. Nobody using the system noticed anything.
Where it stands
In daily use since 2024 as the company's operating system. Manual paperwork and duplicate data entry for these six areas are gone.
Built with
- Django
- Python
- MySQL
- JavaScript · AJAX
- Chart.js
- Bootstrap
- Nginx · Gunicorn
- Linux VPS
Need one of these,
under your name?
Most of what I build reaches the end client with somebody else's logo on it. If that is the arrangement you want, say so in the first message.