Skip to content
View ilhamrafi44's full-sized avatar
😴
Ngantuk..
😴
Ngantuk..

Block or report ilhamrafi44

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
ilhamrafi44/README.md

Bonsky - Senior Full Stack Engineer

LinkedIn Email SBLNET Portfolio

WHOAMI

$ whoami
Muhammad Ilham Rafiannandha

$ whoami --short
Ilham Rafi

$ whoami --what-people-actually-call-me
Bonsky

$ cat ~/.bio
Full stack engineer, 6+ years. I build the systems where being wrong costs
real money -- billing engines, double-entry ledgers, payment gateways, and
the routers that decide whether your stream buffers tonight.

Backend is home        : Java / Spring Modulith, Laravel, NestJS, Go
Frontend when it must look good : Next.js, Vue, React
Mobile when it must fit in a pocket : React Native, Flutter, KMP
Network when the packets need somewhere to go : FreeRADIUS, MikroTik

$ cat ~/.plot_twist
My degree is in English Literature. GPA 3.60.
Four years of Shakespeare, and now I argue with a compiler for a living.
Same energy, honestly. Neither one ever tells you what it actually wants.

$ cat ~/.red_flags
1. I have strong opinions about storing money as integer cents.
   Nobody has ever asked me. I tell them anyway.
2. I wrote an entire CLI from scratch to avoid booting one Windows VM.
   "Ten minutes," I said. Reader, it was not ten minutes.
3. "It's a small refactor" is a sentence I have said out loud, in public,
   to people who trusted me.

$ cat ~/.cat
Cimol. Orange. Sits on the keyboard exclusively during deploys.
Has never once been wrong about anything, and knows it.

$ sudo make me a sandwich
Okay.

6+ years shipping, 11 companies and clients, 25+ products shipped, NaN known bugs, 1 cat named Cimol

* this tile used to say 0. That claim was, itself, the bug. NaN is the honest answer — the count exists, I am simply not prepared to compute it.

NOW

  • 🛰️ Keeping Jakarta online at SBLNET — an ISP platform where 27 Spring Modulith modules, 8 PostgreSQL databases and a rack of MikroTik routers collectively decide whether your stream buffers tonight. Genuinely no pressure.
  • 🏠 Two property platforms in production — BigProperty and White Box. Real bookings, real money, real messages at 2 AM.
  • 📸 Itoya Self Photo Studio — the booking platform and the remote-management agent that babysits the studio PCs. Because when a booth freezes at midnight, somebody has to reboot it, and I would prefer that somebody to be a C++ daemon rather than me, in a car.
  • 🍎 mfu-macos — a native Xiaomi bootloader-unlock CLI for Apple Silicon, written entirely out of spite for having to boot Windows.
  • 📈 nocturads — a CPA routing engine in Go + Fiber + SvelteKit + TimescaleDB, because apparently my idea of resting is writing another backend.

THE ARSENAL

Stack: backend, frontend, mobile, data, infrastructure, network, payments, systems

Cimol walking across the page

WAR STORIES

Most of what I have shipped lives in employer and client repositories — private, and in several cases repositories my access ended with the contract. Eight public repos is not the size of the work; it is the size of what I am allowed to hand you. So: the systems, what was hard about them, and a live URL wherever one still exists.

🛰️ ISP Subscriber Platform — SBLNET

An entire ISP's subscriber lifecycle in one platform: onboarding → automated network provisioning → recurring billing → double-entry accounting → payment collection across multiple gateways and a direct host-to-host bank integration.

Architecture 27-module modular monolith on Spring Modulith — hexagonal / DDD, event-driven module boundaries
Persistence 8 PostgreSQL databases, per-context ACID via multi-datasource transaction management
Accounting Double-entry General Ledger, Journal Entries, Chart of Accounts
Billing Invoicing, proration, discounts, PPN/VAT — money as integer cents, because floats and money are a horror film
Payments Pluggable gateway abstraction: Duitku (VA / QRIS / e-wallet / retail) + host-to-host BRI Fixed VA
Settlement HMAC-verified callbacks, deterministic and idempotent VA registration, automatic invoice matching
Collections Dunning and auto-isolation — overdue suspends the line, payment reactivates it in real time
Network FreeRADIUS (AAA) + MikroTik RouterOS — PPPoE, live session monitoring, CoA disconnect, RADIUS accounting
Ops NOC and OLT management: router health, incident tracking, device config backup
Clients Next.js portals + a React Native self-service app, with a Kotlin Multiplatform rewrite in flight

Java · Spring Boot · Spring Modulith · Spring Security + JWT · Spring Data JPA · PostgreSQL · Redis · Next.js · React Native · Kotlin Multiplatform · Jenkins · Docker

📸 Itoya — self-photo studio platform + remote studio management

Itoya is a premium self-photo studio. Customers book a booth online. The booth is a PC. PCs freeze. That second problem is why this project has two halves.

The booking platform — Laravel API, Vue admin and customer dashboards, Flutter mobile app.

The RMM — because driving to a studio at midnight to press a power button is not a career:

  • C++ Windows agent — DXGI desktop capture, JPEG/H.264 encoding, remote input injection
  • C++ relay — uWebSockets server routing agent ↔ dashboard traffic
  • Flutter desktop dashboard — live view and control of every booth
  • Rust server — a v1 built in Rust before the v2 C++ rewrite
  • Linux agent — X11 capture, JPEG streaming, remote shell, process manager

Laravel · Vue · Flutter · C++ · Rust · uWebSockets · DXGI · X11

💳 Finance & Reconciliation Portal — PT Cashlez Worldwide Indonesia

A payment company's back office has exactly one job: prove that every rupiah that moved actually moved. I built the thing that does the proving.

  • Two-stage reconciliation — third-party settlement against bank mutation, then that result against back-office data
  • Discrepancy detection — dispute amounts, missing-in-bank, missing-in-back-office
  • Disbursement module for merchant payouts
  • Deduction module for fees, chargebacks and adjustments

Java · Spring Boot · Next.js · Jenkins · Docker

☕ CoffeeLabs — HRIS, POS, inventory and a face-recognition attendance service

CoffeeLabs is the group I ran development for at PT Cyber Lab Indonesia. It grew into a small suite: company site, HRIS app, back office.

  • HRIS — attendance with GPS check-in and geofence radius, employee management
  • Face-recognition attendance — a separate Python model service plus a Node inference service, so people stop clocking in for each other
  • WhatsApp gateway — a NestJS + Baileys service for notifications
  • Point of Sales, inventory, and an income journal system
  • Led the development team and ran the internship programme

Laravel · Java (Spring Boot) · Next.js · Vue · React Native · Python · NestJS · Jenkins · Docker

🕋 Umrah & Hajj platforms — Elteyba Tours and SmartHajj

Pilgrimage travel is a logistics problem wearing a religious hat: passports, visas, seat quotas, flight manifests, hotel room-sharing, instalment payments, and a deadline that does not negotiate.

Elteyba Tours — licensed PPIU & PIHK agency, plus the jamaah portal:

  • Multi-role access (admin, agent, jamaah, coordinator) with approval flows
  • Registration with passport/visa upload, group registration, package selection
  • Automated invoicing, down-payment and instalment tracking, payment reminders
  • Real-time seat quota, schedule assignment, flight and hotel management
  • Visa tracking with status workflows and API/CSV export
  • Manifest generation: flight grouping, hotel room-sharing logic, PDFs for immigration
  • WhatsApp broadcast with email fallback, queue-based notifications, daily backups

SmartHajj — a later take on the same domain: Laravel backend, Flutter app.

Laravel · Sanctum · Livewire · Spatie Permission · Vue 3 · React Native · Flutter · MySQL/PostgreSQL · Redis · Midtrans · WhatsApp API

🎟️ Taman Safari Bogor — ticketing from the gate to the back office

Built for GlobalTix Teknologi Indonesia: the domestic ticketing site, its back office, and GT Checker, the React Native app staff hold at the park entrance.

  • domestic.tamansafaribogor.com — public ticketing plus the back office behind it
  • GT Checker (React Native / Expo) — QR and barcode scanning built for a queue, not a demo, with on-device ticket printing
  • Fraud detection — reused and forged tickets rejected at the gate rather than discovered in a report afterwards
  • Integrated with the park's existing ticketing infrastructure, and iterated on feedback from the people actually standing at the turnstile

The app and back-office repositories belong to the client, and my access ended when the contract did — which is how most contract work goes. The live site is the part I can still point at.

React Native · Expo · QR / barcode scanning · thermal printing · REST APIs

🇯🇵 Spectro & ArkaLearn — getting Indonesians hired in Japan

Two products, one funnel. ArkaLearn teaches Japanese for work — JLPT N5 through N3, SSW preparation, mensetsu (interview) practice. Spectro is the job portal those learners graduate into.

The domain constraint shapes everything: the users are, by definition, still learning a language, and they are applying for a visa category with its own paperwork.

  • Two-sided marketplace — candidate and employer profiles, role chosen at signup, Google OAuth
  • Faceted job search across category, industry, type, career level, experience and qualification — six independent axes, because "worker" is not a search query
  • Applications tracking, saved jobs, employer following, per-job view analytics
  • In-app messaging (conversations and messages) so hiring does not degrade into a WhatsApp thread nobody can audit
  • SSW document handling for Japan's Specified Skilled Worker visa track — the part where a missing file costs someone a job offer
  • Multi-language throughout, plus a blog with categories. If your users are learning Japanese, you cannot assume they read English either

Laravel · Blade · MySQL · Google OAuth · Docker

🏛️ DPUPR Musi Banyuasin — a government portal on a CMS I actually wrote

dpupr.mubakab.go.id is the public portal for the Public Works and Spatial Planning agency of Musi Banyuasin Regency, shipped under the name INFRALOK.

The easy version of this job is a theme and a plugin directory. The problem with the easy version is that the people updating the site are civil servants, not developers, and every plugin is a future CVE somebody else has to patch.

So it runs on a purpose-built Laravel CMS instead:

  • Pages and posts with categories and tags
  • Nested menu builder — menus and menu items as first-class records, so navigation is edited, not deployed
  • Media library for documents and images
  • Composable home page — HomeSection / HomeSectionItem let the landing page be rearranged from the admin panel without touching a Blade file
  • Role-based admin for the staff who keep it current

Small surface area, no plugin ecosystem to audit, and nobody has to call me to publish an announcement.

Laravel · Blade · Tailwind · MySQL

🔥 Multilingual site + sales CRM — PT Taiba Cococha Indonesia

A coconut-shell charcoal exporter. The site sells in three languages; the CRM runs the pipeline.

  • Trilingual company profile (English / Indonesian / Arabic) → taibacoco.co.id
  • CRM — contact and lead management, status tracking, reminders, Excel/CSV import-export
  • Sales pipeline — deal tracking, funnel metrics, performance reports
  • Task scheduler — calendar view, assignments, automated follow-up notifications
  • Invoice and quotation module with PDF generation and e-signatures
  • Security — 2FA, session logs, audit trails, permission-based access

Laravel · Passport · Spatie Permissions · Queues & Events · Vue 3 + Pinia · MySQL · Redis · DomPDF

CAREER

Role Company Period
🛰️ Senior Full Stack Engineer PT Surya Bestari Lestari (SBLNET) Dec 2025 — Present
💳 Full Stack Developer (Contract) PT Cashlez Worldwide Indonesia Mar 2025 — Dec 2025
🧩 Full Stack Developer (Contract) · Team Lead PT Cyber Lab Indonesia (CoffeeLabs) Jun 2023 — Feb 2025
🎓 Full Stack Developer (Freelance) ProSpark Pte Ltd · Singapore Jul 2024 — Aug 2024
🎟️ Full Stack Developer (Freelance) Taman Safari Indonesia · Bogor Nov 2023 — Jan 2024
🌏 Full Stack Developer (Freelance) PT Arka Spektrum Solutindo Sep 2023 — Dec 2023
🗽 Mobile Developer (Freelance) Nghbr INC · New York City Jun 2023 — Aug 2023
🧘 Full Stack Engineer (Freelance) Remedi Indonesia Nov 2022 — May 2023
🕋 Full Stack Developer (Contract) PT Elteyba Medina Fauzana Apr 2021 — Nov 2022
🔥 Full Stack Web Developer (Contract) PT Taiba Cococha Indonesia Feb 2020 — Apr 2021
📺 Full Stack Web Developer (Internship) TVRI Mar 2017 — Sep 2017

Jakarta, Indonesia unless noted otherwise.

The shorter engagements, for completeness

ProSpark Pte Ltd — Singapore · Learning Management System. Built and maintained an LMS for workforce training and reskilling. Laravel back end plus front-end integration, maintenance and optimisation.

Taman Safari Indonesia — Bogor · Ticketing platform. Site, back office and the gate-checker app, for GlobalTix Teknologi Indonesia — see the war story above.

PT Arka Spektrum Solutindo — EduTech job portal. Built Spectro and ArkaLearn end to end — see the war story above.

Nghbr INC — New York City · Hyper-local tech networking app. Built the React Native (Expo) app: translated complex UI/UX into pixel-perfect interfaces, integrated REST APIs with real-time sync, and kept the UI consistent across every screen size someone could hand me. The company site is at nghbr.framer.website — a Framer build, not mine. The app repo is client-owned and private.

Remedi Indonesia — Corporate wellbeing platform. Owned architecture for mobile and backend: cross-platform React Native app on a secure Laravel API, real-time chat, third-party integrations, and data-privacy practices for genuinely sensitive user data.

TVRI — National public broadcaster. Front-end maintenance for tvri.go.id and full stack development for newstvri.com.

SHIPPED IT

Live right now:

Product What it is
SBL Net Fiber-optic ISP — subscriber platform, billing, provisioning sblnet.id ↗
Big Property Apartment and room booking platform bigproperty.online ↗
White Box Property Daily and transit apartment rental — Bekasi, Cikarang, Bogor propertywhitebox.com ↗
Itoya Self-photo studio booking + remote studio management itoya.my.id ↗
The Great Taman Safari Bogor Domestic ticketing site + back office, with a React Native gate-checker app domestic.tamansafaribogor.com ↗
DPUPR Musi Banyuasin Government agency portal ("INFRALOK") on a custom Laravel CMS dpupr.mubakab.go.id ↗
ArkaLearn Japanese-language EdTech (JLPT N5-N3, SSW) feeding the Spectro job portal arkalearn.com ↗
CoffeeLabs Company site coffeelabs.co.id ↗
CoffeeLabs HRIS Attendance, GPS geofence, face recognition app.coffeelabs.co.id ↗
CoffeeLabs Back Office Admin and operations console admin.coffeelabs.co.id ↗
Elteyba Tours Umrah & Hajj agency platform elteybatours.com ↗
Elteyba GO Jamaah portal elteybago ↗
Aerocam Global Technology (ex-Indonesia Aero Camera) Drone training centre. I built the original 2021 site; the company has rebranded and rebuilt since, though elements of mine survive on the current one aerocam.co.id ↗
Taiba Cococha Trilingual corporate site (EN/ID/AR) + sales CRM taibacoco.co.id ↗
Gudang Dus Bandung B2B custom packaging catalogue — products, categories, tags, client showcase, self-serve admin gudangdusbandung.com ↗
Hasanain Center Company profile + registration system instagram ↗
Cahaya Al-Kahfi Donation platform facebook ↗
SmartHajj Umrah & Hajj platform — Laravel + Flutter smarthajj.co.id

On Aerocam: the 2021 build was mine, the current site largely is not — I would rather say that than quietly claim a redesign somebody else shipped. The old iac.co.id domain now belongs to an unrelated company, so it is deliberately not linked.

The packaging site's <title> ends with "It's Over 9000!". That was a deliberate decision, made by a grown adult, for a company that sells cardboard. I regret nothing.

Retired — shipped, served their purpose, then the domains lapsed: CoffeeLabs Journal (2023), Sabilec / PT Saudara Bina Electric (2023), Gravilla.id hotel & ticket booking (2022), Safara Digitech (2020), Segment Events (2020), newstvri.com (2017).

TALKED AT PEOPLE

  • 2022 — Speaker, "Web Application in the World of Work" — HMIK Talk, Pertamina University
  • 2022 — Main speaker, "Ngoding Bareng" — Permikomnas Jakarta

Two separate universities handed me a microphone in 2022 and nobody has asked for it back. I choose to read that as a good sign.

Universitas Darma Persada · Jakarta — Bachelor of English Literature, GPA 3.60 / 4.00 · 2018 — 2023

Cimol walking across the page

SAY HI

Got a system that has to balance to the cent, stay online at 3 AM, or ship to both app stores? That is my favourite kind of conversation.

A cat waving hello

🤓 how this profile is built (for the three of you who scrolled this far)

No shields.io, no third-party stat cards, no "AI slop" gradient banner. Every graphic here is an SVG generated by tools/build_assets.py in this repository — each one emitted twice, once per colour scheme, and swapped with <picture media="(prefers-color-scheme: dark)">.

The design language is neo-brutalism: 3–4px black outlines, hard offset shadows with zero blur, flat saturated colour, and Arial Black doing a lot of heavy lifting. Text widths are measured in a real browser rather than estimated, because Arial Black is far wider than any per-character table predicts and labels were spilling out of their boxes.

The cat is Cimol. She is orange, which is the entire personality. She sits in the terminal, sleeps at the foot of the stack, walks across the page twice, occupies a stat tile she did not earn, loafs on the case-study banner, waves at the bottom, and has left paw prints on the hero. She is not decorative. She is load-bearing.

Assets are content-hashed (hero-dark.<hash>.svg) because raw.githubusercontent.com runs Varnish and ignores the query string in its cache key — ?v=2 never busted anything, and a changed asset kept serving stale for five minutes. A hash in the filename is a new path, so it cannot go stale.

The stamp wobbles, the cursor blinks, the cats move, and all of it stops if you have prefers-reduced-motion turned on.

python3 tools/build_assets.py   # regenerates all 28 files in assets/

Interested in new things. Addicted to code. That's all.

Pinned Loading

  1. isp-platform-architecture isp-platform-architecture Public

    How I architected an ISP subscriber platform: 27-module Spring Modulith monolith, 8 PostgreSQL databases, double-entry billing, pluggable payment gateways, FreeRADIUS + MikroTik provisioning.

  2. mfu-macos mfu-macos Public

    Native macOS/Linux/Windows CLI for Xiaomi's official bootloader-unlock API — no Windows VM needed. Unlock Redmi/POCO/Xiaomi from Apple Silicon.

    Python 2

  3. whatsapp-gateway-api whatsapp-gateway-api Public

    WhatsApp gateway + management dashboard — multi-session connections, notification sending and activity monitoring. Node.js, Express and Baileys.

    JavaScript 1

  4. meme-generator-lahelu meme-generator-lahelu Public

    React Native meme generator — canvas-style text and sticker composition with gesture handling and Reanimated, built for the Lahelu meme community.

    TypeScript

  5. siakad-madrasah siakad-madrasah Public

    SIAKAD for madrasah — academic years, classes, subjects, enrollment, grading and announcements, with separate admin, bendahara and guru portals. Laravel + Tailwind.

    PHP