📐 Pasal 3.2b — Technical Documentation

System Architecture & Deployment Guide

Dokumentasi teknis komprehensif arsitektur microservices QRIS Acquirer, panduan deployment lengkap, database schema, CI/CD pipeline, dan security model. Sesuai spesifikasi SPK/2026/05/12/001.

📄 SPK/2026/05/12/001
🗓️ April – Agustus 2026
🖥️ VPS IDCloudHost 103.59.94.229
🐳 10 Docker Containers
🌐 9 Domain Aktif
🗺️ Overview

Overview Sistem

QRIS Acquirer System adalah platform pembayaran digital terintegrasi yang dibangun dengan arsitektur microservices. Sistem menghubungkan merchant, switching Artajasa, dan disbursement Flip dalam satu ekosistem yang scalable.

5
Backend Services
2
Frontend Apps
5
PostgreSQL DBs
1.250
TPS Kapasitas
9
Domain Aktif
99.5%
SLA Uptime
✅
Seluruh 10 Docker container aktif dan running di VPS IDCloudHost (Ubuntu 24.04 LTS, 4 vCPU, 4GB RAM). Sistem telah melewati load testing 1.250 TPS dengan rata-rata response time di bawah 500ms.
🧩 Arsitektur

Arsitektur Sistem

Sistem menggunakan arsitektur microservices yang dikelola oleh Caddy sebagai reverse proxy. Setiap service berjalan dalam Docker container yang terisolasi dan terhubung melalui jaringan internal app-network.

LAYER 1 — CLIENT & DNS
🌏 Browser / Mobile
──→
📡 Cloudflare DNS
──→
🔒 HTTPS :443

LAYER 2 — REVERSE PROXY
🟢 Caddy (TLS Auto · HTTP/2 · gzip/zstd)
pocikode.web.id · nexuscode.web.id · system.pocikode.web.id

LAYER 3 — APPLICATION SERVICES (Docker containers, app-network)
🔐 core-auth
:1500
💰 core-wallet
:1200
💳 core-payment
:1400
🔄 core-transfer
:1300
⚙️ core-worker
:1100
🖥️ dashboard
:3000
🛠️ backoffice
:8000
LAYER 4 — DATA & EXTERNAL
🐘 PostgreSQL :5433
4 schemas
⚡ Redis :6379
cache + queue
🏦 Artajasa
QRIS Switching
💸 Flip
Disbursement
📊 Grafana+Loki
:3200
ℹ️
Semua service backend menggunakan shared app-network Docker bridge, sehingga service dapat berkomunikasi via hostname container (contoh: http://core-auth:1500). Logging-stack menggunakan network terpisah logging-network dan terhubung ke Docker socket untuk collect container logs via Promtail.
🐳 Services

Service Catalog

Rincian setiap service, teknologi, port, database, dan endpoint utama yang tersedia.

Service Stack Port Database Endpoint Utama
core-auth
Autentikasi & User Mgmt		 Go 1.25 Fiber v2 :1500 db_user /api/v1/health
/backoffice/merchant
/backoffice/user
/merchant/auth/login
/internal/merchant
core-wallet
Saldo, Mutasi, Ledger		 Go 1.25 Fiber v2 :1200 db_wallet /api/v1/health
/api/v1/balance
/api/v1/mutation
/api/v1/ledger
core-payment
QRIS Generate & Artajasa		 Go 1.25 Fiber v2 :1400 db_payment /openapi/v1.0/qr/qr-mpm-generate
/openapi/v1.0/qr/qr-mpm-query
/secure/jsonAPI/v1/echo
/secure/jsonAPI/v1/paycredit
/secure/jsonAPI/v1/cut-over
core-transfer
Disbursement & Flip		 Go 1.25 Fiber v3 :1300 db_transfer /api/v1/inquiry
/api/v1/payment
/api/v1/disbursement/flip/transfer
/callback/disbursement/flip
core-worker
Background Jobs & Scheduler		 Go 1.25 Fiber v2 :1100 db_payment /health
/api/v1/jobs/summary
/api/v1/jobs/check-pending
/api/v1/jobs/retry-callbacks
/api/v1/jobs/settlement-cutoff
dashboard-web-app
Portal Merchant		 Next.js 16 React 19 :3000 via API dashboard-merchant.nexuscode.web.id
/login · /onboarding · /admin/*
backoffice-portal
Admin Panel		 Laravel 13 PHP 8.3 :8000 portal_backoffice backoffice.nexuscode.web.id
/login · /merchant · /transaction
logging-stack
Observability		 Grafana 10.4 :3200 file/volume logs.pocikode.web.id
Loki :3100 · Promtail → Docker logs
🗄️ Database

Database Schema

Sistem menggunakan PostgreSQL 16 dengan 5 database terpisah per domain. Setiap service memiliki database isolasi sendiri untuk mendukung prinsip loose coupling.

db_user
PostgreSQL 16 · core-auth
merchants (id, name, nmid, status, ...)
users (id, merchant_id, role, ...)
sessions (id, user_id, token, ...)
merchant_configs (fee, limit, ...)
files (key, url, type, ...)
db_wallet
PostgreSQL 16 · core-wallet
wallets (id, merchant_id, balance, ...)
mutations (id, wallet_id, amount, type, ...)
ledgers (id, ref_id, debit, credit, ...)
settlements (id, date, amount, status, ...)
db_payment
PostgreSQL 16 · core-payment & core-worker
qris_orders (id, merchant_id, amount, qr_string, ...)
artajasa_callbacks (id, order_id, payload, ...)
merchant_callbacks (id, order_id, url, status, ...)
configurations (key, value, ...)
cutoff_logs (id, date, processed_at, ...)
db_transfer
PostgreSQL 16 · core-transfer
disbursements (id, merchant_id, amount, provider, ...)
flip_transactions (id, disbursement_id, flip_id, ...)
inquiries (id, account_no, bank_code, ...)
transfer_logs (id, ref_id, status, ...)
portal_backoffice
PostgreSQL 16 · backoffice-portal (Laravel)
users · roles · permissions · merchant_verifications · audit_logs · sessions · cache
ℹ️
PostgreSQL berjalan di port 5433 (bukan standar 5432) untuk alasan keamanan. Redis berjalan di port standar 6379 sebagai session store, cache layer, dan message broker antar service.
⚙️ Tech Stack

Technology Stack

Seluruh komponen dipilih untuk performa tinggi, keandalan, dan kemudahan deployment.

🐹
Golang
v1.25.0
Backend microservices
⚡
Fiber
v2 / v3
HTTP Framework (Go)
▲
Next.js
16.2.2
Dashboard Merchant SSR
⚛️
React
19.2.4
Frontend UI Library
🔴
Laravel
^13.0
Backoffice Admin Panel
🐘
PostgreSQL
16
Primary Database (5 DBs)
⚡
Redis
7.x
Cache + Queue + Pub/Sub
🐳
Docker
27.x
Containerization
🟢
Caddy
2.x
Reverse Proxy + TLS Auto
📊
Grafana
10.4.2
Log Dashboard
🪵
Loki + Promtail
2.9.8
Log Aggregation
🦊
GitLab CI/CD
Runner
Automated Deployment
🖥️ Infrastruktur

Infrastruktur VPS

Sistem berjalan pada single VPS IDCloudHost dengan spesifikasi berikut.

🖥️ Server Specification
ProviderIDCloudHost
IP Address103.59.94.229
OSUbuntu 24.04 LTS
Kernel6.8.0-134-generic
CPU2 vCPU
RAM4 GB (3.8 GiB)
Disk29 GB SSD
Usertpid_project
📂 Directory Structure
# Aplikasi
/home/tpid_project/app/
├── core-auth/ (5.0 MB)
├── core-wallet/ (1.2 MB)
├── core-payment/ (114 MB)
├── core-transfer/ (884 KB)
├── core-worker/ (580 KB)
├── dashboard-web-app/ (24 MB)
├── backoffice-portal/ (13 MB)
└── logging-stack/ (5.5 MB)

# Web root (Caddy serve)
/var/www/api-docs-portal/
🌐 Port Mapping
Semua service mendengarkan pada 0.0.0.0 (accessible dari Caddy reverse proxy)
:22 SSH :80/:443 Caddy :1100 core-worker :1200 core-wallet :1300 core-transfer :1400 core-payment :1500 core-auth :3000 dashboard :8000 backoffice :3200 grafana (local) :5433 postgres :6379 redis
🚀 CI/CD

CI/CD Pipeline

Setiap push ke branch main di GitLab akan memicu GitLab Runner yang berjalan langsung di VPS untuk auto-deploy.

👨‍💻 git push
developer local
──→
🦊 GitLab
proyek-candi group
──→
🏃 GitLab Runner
VPS (shell executor)
──→
🐳 docker compose
build + up -d
──→
🌐 Live!
📋 deploy-api-docs.sh
Deploy script untuk api-docs-portal (static files)
# Lokasi di VPS: /home/tpid_project/deploy-api-docs.sh
# Cara pakai — dari local setelah git push:

sshpass -p '...' ssh tpid_project@103.59.94.229 "bash ~/deploy-api-docs.sh"

# Yang dilakukan script:
① git fetch + reset --hard # pull versi terbaru
② rsync --delete # sync ke /var/www/api-docs-portal/
③ --chown=caddy:caddy # set owner ke Caddy
④ Exclude .git, tests/ # tidak deploy file dev
🐳 Deploy Backend Service
Untuk update setiap backend service (contoh: core-auth)
# SSH ke VPS
ssh tpid_project@103.59.94.229

# Masuk direktori service
cd ~/app/core-auth

# Pull latest code
git pull origin staging

# Rebuild dan restart container
docker compose build --no-cache
docker compose up -d

# Verifikasi
docker ps --filter "name=core-auth"
curl -s http://127.0.0.1:1500/api/v1/health
→ {"status":"ok"}
📋 Deployment Guide

Deployment Guide — From Scratch

Panduan lengkap setup sistem dari awal pada server baru (fresh Ubuntu 24.04 LTS).

  1. Install Prerequisites
    # Update system
    sudo apt update && sudo apt upgrade -y

    # Install Docker
    curl -fsSL https://get.docker.com | sh
    sudo usermod -aG docker $USER

    # Install Caddy
    sudo apt install -y caddy

    # Install PostgreSQL 16
    sudo apt install -y postgresql-16
  2. Clone Repositories & Setup Environment
    # Clone semua service
    mkdir -p ~/app && cd ~/app
    git clone git@gitlab.com:proyek-candi/core-auth.git
    git clone git@gitlab.com:proyek-candi/core-wallet.git
    git clone git@gitlab.com:proyek-candi/core-payment.git
    git clone git@gitlab.com:proyek-candi/core-transfer.git
    git clone git@gitlab.com:proyek-candi/core-worker.git
    git clone git@gitlab.com:proyek-candi/dashboard-web-app.git
    git clone git@gitlab.com:proyek-candi/backoffice-portal.git

    # Copy dan isi .env untuk setiap service
    cp core-auth/.env.example core-auth/.env
  3. Setup Database & Docker Network
    # Buat databases
    sudo -u postgres psql -c "CREATE DATABASE db_user;"
    sudo -u postgres psql -c "CREATE DATABASE db_wallet;"
    sudo -u postgres psql -c "CREATE DATABASE db_payment;"
    sudo -u postgres psql -c "CREATE DATABASE db_transfer;"
    sudo -u postgres psql -c "CREATE DATABASE portal_backoffice;"

    # Buat shared Docker network
    docker network create app-network
  4. Build & Start Backend Services
    # Start semua service (urutan penting!)
    cd ~/app/core-wallet && docker compose up -d --build
    cd ~/app/core-auth && docker compose up -d --build
    cd ~/app/core-payment && docker compose up -d --build
    cd ~/app/core-transfer && docker compose up -d --build
    cd ~/app/core-worker && docker compose up -d --build

    # Frontend
    cd ~/app/dashboard-web-app && docker compose up -d --build
    cd ~/app/backoffice-portal && docker compose up -d --build

    # Logging stack
    cd ~/app/logging-stack && docker compose up -d

    # Verifikasi semua container
    docker ps --format "table {{.Names}}\t{{.Status}}"
  5. Konfigurasi Caddy Reverse Proxy
    # Edit Caddyfile
    sudo nano /etc/caddy/Caddyfile

    # Reload Caddy setelah edit
    sudo systemctl reload caddy
    sudo caddy validate --config /etc/caddy/Caddyfile

    # Caddy otomatis handle TLS/SSL via Let's Encrypt
    ✓ HTTPS tersedia otomatis untuk semua domain
  6. Verifikasi Health Check Semua Service
    curl -s http://127.0.0.1:1100/health # core-worker
    curl -s http://127.0.0.1:1200/api/v1/health # core-wallet
    curl -s http://127.0.0.1:1300/api/v1/health # core-transfer
    curl -s http://127.0.0.1:1400/api/v1/health # core-payment
    curl -s http://127.0.0.1:1500/api/v1/health # core-auth
    curl -s http://127.0.0.1:3000/ # dashboard
    curl -s http://127.0.0.1:8000/ # backoffice
🌐 Reverse Proxy

Konfigurasi Caddy

Caddy berfungsi sebagai entry point semua traffic, mengelola TLS otomatis via Let's Encrypt, dan melakukan routing ke service yang sesuai.

# /etc/caddy/Caddyfile

pocikode.web.id {
  root * /var/www/api-docs-portal
  file_server
  rewrite * /pocikode-landing.html
}

system.pocikode.web.id {
  root * /var/www/api-docs-portal
  file_server
  rewrite * /system.html
}

api.pocikode.web.id {
  encode gzip zstd
  handle_path /auth/* { reverse_proxy 127.0.0.1:1500 }
  handle_path /payment/* { reverse_proxy 127.0.0.1:1400 }
  handle_path /transfer/* { reverse_proxy 127.0.0.1:1300 }
  handle_path /wallet/* { reverse_proxy 127.0.0.1:1200 }
  handle_path /worker/* { reverse_proxy 127.0.0.1:1100 }
  handle / { root * /var/www/api-docs-portal; file_server }
}

dashboard-merchant.nexuscode.web.id {
  reverse_proxy 127.0.0.1:3000
}

backoffice.nexuscode.web.id {
  reverse_proxy 127.0.0.1:8000
}

logs.pocikode.web.id {
  reverse_proxy 127.0.0.1:3200
}
📊 Logging

Logging Stack & Observability

Semua log dari container Docker dikumpulkan secara otomatis via Promtail, dikirim ke Loki, dan divisualisasikan di Grafana.

🐳 Docker Containers
stdout/stderr logs
──→
🦜 Promtail
:docker socket
──→
🗃️ Loki
:3100 (local)
──→
📊 Grafana
:3200 → logs.pocikode.web.id
ℹ️
Promtail mount /var/lib/docker/containers dan /var/run/docker.sock untuk collect log semua container secara otomatis. Memory limit: Loki 250MB, Promtail 100MB, Grafana 200MB.
🔐 Security

Security Model

Implementasi keamanan berlapis sesuai OWASP API Top 10 dan standar QRIS Bank Indonesia.

🔑 Authentication & Authorization
  • ✅ OAuth 2.0 B2B Token (SNAP Standard)
  • ✅ JWT dengan expiry & refresh token
  • ✅ RBAC (Role-Based Access Control)
  • ✅ Internal Signature HMAC untuk antar-service
  • ✅ Session management via Redis
🛡️ API Security
  • ✅ HTTPS / TLS 1.3 (Caddy auto-cert)
  • ✅ Idempotency Key pada transaksi payment
  • ✅ Rate limiting & request validation
  • ✅ CORS headers dikonfigurasi per domain
  • ✅ Security headers (HSTS, X-Frame-Options)
🔍 Audit & Compliance
  • ✅ Immutable audit trail (ledger anti-manipulasi)
  • ✅ Centralized log — semua request tercatat
  • ✅ Pen-test internal OWASP API Top 10
  • ✅ Zero critical vulnerability ditemukan
  • ⏳ Pentest eksternal (auditor independen)
🏦 Integration Security
  • ✅ Artajasa — HMAC-SHA512 request signing
  • ✅ Flip — Webhook signature validation
  • ✅ Callback URL whitelist per merchant
  • ✅ Sandbox / Live mode separation

Tim Pengembang QRIS Acquirer · Nomor SPK: SPK/2026/05/12/001

Portal · API Docs · Performance · Progress