TechStack

In-house engineering & operations

We build and run the systems retail runs on.

A small in-house technology team covering the whole path from product code to production servers: ERP, point of sale, marketplace integrations, data, and AI assistants for every member of staff. We run all of it on infrastructure we operate ourselves.

See capabilities Get in touch
16+production hosts in two regions, all self-operated
~40AI assistants, one per staff member or team
5Postgres clusters with point-in-time recovery
0managed-cloud lock-in: no Kubernetes or hyperscaler dependency

Capabilities

Each of these runs in production today, with real users and real data. We wrote or integrated it, we deploy it, and we get the alert when it breaks.

01

Business platforms

An ERP that runs daily operations for several consumer brands: sales, stock, logistics, HR, payments and task management.

  • Node.js ERP behind a load-balanced process cluster
  • Point-of-sale web app for physical stores
  • Customer API, mobile app backend, SMS handling
  • Command-line client for staff and automation
Node.jsTypeScriptMongoDBPM2
02

Commerce & marketplace integration

Store, marketplace and ads data flowing into one system, with automated token handling so connectors keep working without anyone stepping in.

  • Marketplace shop integrations with automatic token refresh
  • Ads-performance reviews and daily proposals
  • Shipping-partner order tracking
  • Promotions and pricing programmes by product
RESTOAuthBullMQRedis
03

AI assistants for staff

A fleet of personal and team AI agents in the company chat. Each one acts in the ERP with its owner's permissions and is traced end to end.

  • One assistant per person or team, separate config and credentials for each
  • Tool access to ERP, docs, calendar and ads platforms
  • LLM observability: every turn traced, costs and failures monitored
  • Several model providers, switchable per assistant
LLM agentsMCPLangfuseDocker
04

Data & reliability

Replicated databases, tested restores, and backups to object storage, so losing a machine doesn't lose data.

  • MongoDB replica set with logical + oplog backups, restore drills
  • PostgreSQL continuous archiving and point-in-time recovery
  • Redis with Sentinel failover; a full search engine for the ERP
  • Analytics warehouse feeding BI dashboards
MongoDB 8PostgreSQLWAL-GPBMR2
05

Infrastructure & networking

Virtual machines across two regions plus on-premises boxes, joined by a private mesh network and fronted by a CDN and zero-trust access.

  • Load balancing and TLS at the edge, automatic certificates
  • Private WireGuard mesh across every server and office machine
  • Zero-trust login wall for internal tools
  • Regional failover runbook for the core ERP
CaddyTailscaleCloudflareDebian
06

Observability

Uptime, host metrics, logs, traces and job queues, monitored with self-hosted tools first and paid ones only where they earn their cost.

  • Uptime probes and heartbeat checks for scheduled jobs
  • Host metrics on every machine, 30-day central log store
  • Queue-throughput monitoring that catches silent stalls
  • Alerts routed to team chat, with run-books linked
Uptime KumaBeszelVictoriaLogsAPM
07

Delivery pipeline

Self-hosted source control and CI, a production-mirror staging environment, and one-command deploys.

  • Git forge with code review, CI runners on our own hardware
  • Staging rebuilt nightly from recent production data
  • Any open branch deployable to staging for testing
  • Versioned web releases, rolling process reloads
GiteaDrone CIpnpmCloudflare Pages
08

Collaboration platforms

The tools the whole company works in, run and upgraded in-house, with Vietnamese-language search.

  • Team chat with full-text search and notification bots
  • Learning-management system for staff training
  • Internal wiki, link shortener, BI dashboards
  • Secrets manager with per-service identities
MattermostMoodleMetabaseInfisical
09

Security & store edge

Least-privilege access, fast response when a CVE comes out, and remote support for the PCs and printers in stores and the warehouse.

  • Read-only and per-service database users
  • Kernel and service mitigations across the whole fleet on the day a CVE lands
  • Remote management of Windows label-printing PCs
  • Short-lived, scoped API tokens for every integration
Least privilegeSSHZero trust

Track record

Some recent work, summarised without any confidential details.

Database upgrade across four major versions

Moved the primary MongoDB replica set from 4.4 to 8.x one version at a time, with rolling restarts and the ERP serving traffic throughout.

Point-in-time recovery for every Postgres

Added continuous WAL archiving to object storage for all five production Postgres clusters, with monitored backup freshness.

Silent queue stalls made visible

A job queue once stalled for weeks while every health check stayed green. We added throughput heartbeats so a stall now raises an alert within minutes.

Chat platform major upgrade

Upgraded the company chat a full major version and added a search engine tuned for Vietnamese text.

AI assistant fleet, observed end to end

Rolled out dozens of staff assistants, each with its own config and credentials, plus tracing, cost metrics and failure monitors.

Same-day CVE mitigation

Mitigated a kernel networking vulnerability on every exposed host the day it was published, and kept that in place until patched kernels shipped.

How we work

The habits that let a small team run a large estate.

Every operation leaves a run-bookWe write down each host, upgrade and incident as we go: what changed, why, and how to undo it.
Self-host first, buy where it paysWe use open-source tools where they cover the need, and buy a product only when it closes a gap we have measured.
Humans approve production writesAutomation and AI agents draft and verify on staging. A person runs every change against production data.
Backups are proven by restoring themWe count a backup only after we have restored it on a scratch environment.
AI-assisted, and labelled as suchWe use AI agents heavily in operations and development, and every message an agent writes says so.

Stack

What we run in production today.

Application

Node.js · TypeScript
Bun · Python · Go
PM2 · Docker
BullMQ

Data

MongoDB 8 · PostgreSQL
Redis + Sentinel
ClickHouse · OpenSearch
MariaDB · Elasticsearch

Platform

Debian · Arch
Caddy · Tailscale
Cloudflare (CDN, R2, Pages, Access)
Gitea · Drone CI

Operations

Uptime Kuma · Beszel
VictoriaLogs · Langfuse
WAL-G · Percona Backup
Infisical

Work with us

We take on integrations, platform migrations and operations work, and we're always happy to compare notes with other teams who self-host.

tech@handytech.vn