Fuelsgate
B2B Petroleum SaaS — Marketplace & Station Operations Platform
Key Technical Highlights
Multi-tenant hierarchy (Account → Region → Station) with permission scope resolved live at query time, so access changes take effect immediately with no manual re-grant
Built a cost-attribution and P&L reporting engine with immutable closing snapshots, so a later correction can never silently rewrite a closed period's numbers
Redesigned daily record review to surface only items that genuinely need attention, instead of a queue nobody reads — the difference between review that happens and review that doesn't
Unified correction/adjustment framework handling ten distinct real-world correction types through one audited mechanism, instead of one-off code paths per type
Security-by-topology Docker Compose deployment — only nginx publishes ports — plus a 'no codebase on the server' release model with three separately-scoped credential tiers for CI, server, and runtime secrets
The Case Study
The Problem
The original Fuelsgate was a MongoDB/Mongoose marketplace app connecting fuel buyers, depot sellers, and transporters. It worked, but the data model and layering couldn't carry the next phase of the product: retail station operations, tiered account permissions, and a training-to-employment pipeline. Rather than keep patching a schema that had outgrown its shape, the whole platform was rebuilt from scratch.
The Rebuild
Fuelsgate is now a NestJS + Prisma + PostgreSQL API behind three purpose-built Next.js frontends (customer dashboard, admin console, public marketing site) and a FastAPI microservice for AI features, in a pnpm/Turborepo monorepo — solo-designed, solo-built, and solo-deployed to a self-managed VPS across 16+ build phases in about a month. Full ownership: architecture, data modeling, backend, frontend, DevOps, and security.
Architecture
Every layer is enforced, not just conventional: controller (HTTP only) → service (business logic) → repository (Prisma only) → DTO, with zero Prisma access permitted outside repositories. The tenancy model is a genuine hierarchy — Account → Region → Station — with permission scope resolved live at query time rather than snapshotted at grant time, so an access change takes effect immediately with no manual re-grant.
Cost Attribution & Reporting
A core piece of the station-operations layer turns raw operational data into accurate, tamper-evident profit-and-loss reporting. Once a reporting period closes, its figures are snapshotted immutably and never silently recomputed — so a later correction can't quietly restate a closed period's numbers. A companion correction process handles late-arriving data by posting a disclosed adjustment rather than mutating anything already closed out, verified end-to-end against a full reconciliation script.
Data Integrity as a Design Principle
Corrections follow an accounting "adjusting entry" philosophy: a submitted record is treated like a filed document — never rewritten in place, with every correction a named, dated, auditable object. Daily review was redesigned to surface only records that genuinely need a human's attention, rather than queuing everything — the difference between a review process people actually use and one nobody reads.
Security & Deployment
Production runs as a single-VPS, multi-service Docker Compose topology (7 containers) where only nginx publishes ports — every other service, including an unauthenticated internal AI microservice, is reachable only on the compose network. Deployment follows a deliberate "no codebase on the server" model: production runs published container images plus a handful of explicitly-listed files, with CI, server, and runtime secrets kept in three separately-scoped credential tiers so a compromised CI token can never yield the database password. Backups run on a two-tier system — six-hourly self-verifying dumps plus continuous WAL archiving — tested with a real restore drill, not just documented.
Verified, Not Just Written
The project ran under a hard rule: a checklist item stays unchecked until it's been curled against a live endpoint or clicked through as the real user in a browser. That discipline caught real bugs before they shipped — a live privilege-escalation path where a scoped account member could widen their own access, a "front door locked, back door open" leak where a request was correctly scope-refused but a related download endpoint wasn't, and a cross-account authorization hole that let one company silently reassign another's assigned staff member.