A production licensing backend for a cloud marketplace. The marketplace sells the add-on; this service decides what the buyer is entitled to, signs the licence, and answers the software that asks whether it may run — online, offline, behind NAT, or with no internet at all.
One Go binary with the operator console compiled into it, deployed as one container image. No microservice sprawl, no framework magic — a small number of deliberate architectural decisions, each enforced by a test that fails the build when someone drifts from it.
A cloud marketplace handles the transaction and the billing. It does not handle anything a software vendor actually needs once the purchase is made.
The marketplace sends a plan slug and expects config variables back within a hard deadline.
It may be behind NAT, rebuilt every deploy, cloned, or unable to reach the internet at all.
The marketplace is silent on enforcement after a deprovision — the policy is the vendor’s to define and defend.
The marketplace publishes no way to read a resource back. Lose the record of what was sold, and it is gone.
So the service has to be the system of record, answer a hard real-time contract on the purchase path, and keep paying customers running when it is itself unreachable. Those three constraints drive nearly everything that follows.
The public surface, the operator console and the metrics exposition each bind their own port. The console’s single-page app answers any unclaimed path — exactly why it must never sit on the public listener. Route registration lives in one function so a test can read the result: a surface added to the wrong listener fails the build instead of being published.
Exactly three environment variables exist. The other 28 settings are rows, editable from the console, with values that can be Secret Manager references. They take effect at restart by design — the encryption key set is the one exception, reloaded on SIGHUP, because widening what can be read harms nothing mid-request.
The transports only decode, call and encode. This is the most important invariant in the codebase: a rule enforced over HTTP and forgotten over the websocket is a licence bypass, and the only reliable prevention is exactly one implementation. The websocket exists for clients behind NAT that cannot be polled.
| Strategy | Bound by | Caller can assert it? | Survives NAT | Survives a rebuild |
|---|---|---|---|---|
| ip_binding | Address observed on the connection | No | No | No — needs a rebind |
| activation_code | The plan’s seat ceiling | Yes — self-reported install id | Yes | Yes |
| none | The SSO token; nothing is issued | — | — | — |
Every licence is ed25519-signed. A standalone Go package with no dependencies beyond the standard library verifies it on the customer’s machine — a public key verifies licences, it cannot mint them.
// verify on start, keep running if valid
pub, err := licensecheck.DecodePublicKey(embeddedKey)
claims, err := licensecheck.Verify(pub, licenceKey)A suspended or deprovisioned resource stays entitled for a configured window — 72 hours by default — and says so with a grace_until timestamp, so software can warn rather than stop. Suspension usually means a late invoice.
Grace lives on the listing — the vendor’s tolerance for late payment. Seat ceilings, which a buyer pays for, live on the plan.
19 columns sealed with AES-GCM, each ciphertext bound to its row by associated data — a value lifted from one row fails to decrypt in another. Every value names its key, so rotation is an online operation with per-column status proving when it is finished.
A callback URL that resolved publicly when stored can resolve to 169.254.169.254 by the time a worker posts an access token to it. Addresses are checked when dialled and redirects are refused — a finding from a mutation test, not a hypothetical.
The entitlement endpoint is unauthenticated by necessity, so it is designed not to be an oracle: unknown credentials are indistinguishable, malformed bodies look the same, and a rate-limit refusal is a 429 with an empty body.
Every endpoint declares its permission, target resolver, or a named exemption saying why it needs none. The router is built from that table and a test compares the two — an unguarded endpoint fails the build.
Buyers are handed from the marketplace to a vendor dashboard via a verified HMAC handoff and a single-use code. The authorize endpoint is deliberately disabled and no refresh token is issued — there is nothing for a buyer to sign in to.
A buyer has no account, password or session here — not even a short-lived one. Removing that boundary removes an entire category of attack surface; customer machines are not IAM principals either.
| Caller | Proves it by | Gets |
|---|---|---|
| Marketplace | Basic auth, per listing | The four vendor endpoints for that listing |
| Marketplace, at SSO | HMAC-SHA256 keyed by the listing salt | A single-use handoff |
| Licensed software | Activation code, licence key or bound address | One question: may it run |
| A dashboard | client_secret_basic at the token endpoint | A token for one buyer |
| An operator | Password + TOTP | A console session, within their grants |
| A machine | Bearer token | Its grants, minus four forbidden permissions |
A Vue 3 + Vuetify single-page console in TypeScript, embedded with go:embed so the deployable stays one file. Accessibility is treated as a correctness property: colour never carries meaning alone, filtering is announced to screen readers, and dialog focus is shared behaviour rather than per-page improvisation.
A dialog that is a route, so Escape, the scrim, Cancel and Back all agree on what closing means.
State as colour and icon, so it survives a screenshot and a reader who cannot distinguish hue.
A visually hidden live region announcing how many rows a filtered table now shows.
CSRF token held in memory, not localStorage; 401 handled once; a 30-second timeout so no spinner runs forever.
Two places told an operator to create a signing key from a product page that could not do it — and a product with no key fails every purchase. The control now lives where the text pointed, and the product page shows the key, or none — cannot issue a licence, matching on usable rather than merely active.
What does the person need at this moment, and what does the screen let them believe that is not true?
“A build that can restart production is a merge that can restart production.”
654 Go test functions and 65 end-to-end tests driven through the real UI. The real contribution is a category: structural tests that fail the build when an architectural decision is violated, rather than only examples of behaviour.
35 domain metrics plus four HTTP families. A Prometheus registry never releases a series, so no label ever takes a value the caller chose: the Host header is emptied, methods collapse to an allowlist, and 404 paths collapse — keeping the 404 rate visible without keeping the paths.
Structured JSON logs, separate liveness and readiness, and a documented alerting guide round it out.
Accepted-but-unreported, overdue past SLA, age of the oldest — the only place a customer workflow that died shows up at all.
Must be zero. Non-zero means data sealed under a key the process no longer holds.
A licence issued without its IP binding — previously visible only as one ERROR log line.
Which listener answers what is the security boundary; a test reads the mount table so a misplaced surface fails the build.
Operators change behaviour without a redeploy; only three environment variables exist and secrets stay references.
A service that changes behaviour mid-request cannot answer “what was the config when this happened?”
A rule enforced over one transport and forgotten over the other is a licence bypass.
The vendor’s outage must not take a paying customer’s software down.
Grace is tolerance for late payment; seats are what a buyer pays for.
Retrying a rejected request forever hides a contract violation as a transient fault.
A subscriber being down must never fail the change that produced the event.
The existence of a resource is itself information.
A replayed provision is a replay because the database says so, not because a code path remembered.
A build that can restart production is a merge that can restart production.
Push a container without the default account’s roles/editor and access to every secret.
Failing the purchase would be worse, but the buyer held a key that answered ip_not_bound to every check, with one log line as evidence. It is now counted by reason, and the console shows the live binding beside the reported address.
Found by a mutation test. Fixed by refusing redirects and checking addresses at dial time — with a deliberately permissive client kept for the operator-configured API base, because the two cases deserve opposite treatment.
Three label leaks on a public listener, found by scraping a running binary and in review. Fixed with an allowlist-and-collapse strategy rather than one-off patches, locked down by a test.
The test that catches a table the dev wipe misses had been broken for two migrations, because go test ./... never compiled its build tag. It now has its own CI step.
The service started, readiness stayed green and existing licences validated — only new purchases failed, one at a time. Moving configuration into the database made it fail at startup with a message naming the cause.
A single container one person can roll forward or back with two commands — and the vendor’s system of record for every resource, licence and buyer.
Purchase to signed licence inside the marketplace deadline, replay-safe, on two provisioning models.
Entitlement over two transports, with offline verification so a vendor outage never stops a customer.
A 41-page console, a 12-group CLI, and runbooks for every failure the design anticipates.
Per-column encryption with zero-downtime rotation, scoped RBAC, and a public surface that is not an oracle.
I led the design and the engineering decisions: the security boundaries, the data model, the failure taxonomy, the deployment shape, the test strategy, and what the documentation had to prove. I also did the coding, working with AI pair-programming — I set the architecture, wrote the implementation, drove the reviews, and owned what shipped.
Described generically — company, product, domain and infrastructure identifiers are deliberately omitted.
Built in 2026 for an internal product: zero inbound ports on any machine. Commands run in order per machine and in parallel across the fleet, and every command gets an answer.
Read the case study →SaaS · Cloud marketplace · Server automationv1 shipped February 2025. Sites, SSL, PHP, databases, backups and WordPress itself are run from the browser, with Stripe billing on top.
Read the case study →Next