Ventures — The GCStore Constellation

GCStore is the software venture of Gabriel Capeletto LLC: a constellation of products in production — an app store with device-bound licensing shipped on every machine the company sells, a live marketplace storefront, SaaS products (recruiting, video), and a market-data platform — built from scratch by one engineer, orchestrated around a single identity & entitlement core.

This page is the Level-1 system design: the components, their trust boundaries, and the integration fabric that binds them. Each component will get its own Level-2 deep-dive (internal architecture and design decisions) — this is a living portfolio of systems that are selling and serving real customers today, not a lab exercise.

The components

1. gcstore-server — the core
   • Source of truth for customer identity, entitlement, app catalog, licensing & delivery across every product.
   • Mints short-lived Ed25519 (EdDSA) tokens that apps verify offline; projects entitlement into Keycloak roles; serves the admin API the ERP drives.
   • Composable entitlement: plans grant scopes and include other plans (store → app → feature) — new tiers are data, not code.
   • Go · MySQL (sqlc, typed SQL, versioned migrations) · Docker multi-stage → distroless.
2. GCStore Hub — production
   • Desktop client installed on every machine the company sells: device-bound licensing (hardware fingerprint, optional TPM tier), catalog, gated app install/delivery.
   • Push channel to the installed fleet: offers/announcements published from the ERP admin arrive as notifications (the GC Deals inbox).
   • Self-updating; releases ship via GitHub Actions on tag. Untrusted by design — every decision is server-side.
   • C# / .NET (Windows) · GitHub Actions release pipeline · public contract repo.
3. GCStore Shop — production (alpha/beta, evolving daily)
   • The marketplace storefront, live with real products fed by the ERP's listings. Public anonymous catalog; identified checkout; payments operating (Zelle and PayPal live); order tracking and transactional email.
   • Centerpiece: highly configurable products — a base listing carries options and per-variant pricing, so the buyer composes the exact machine and the catalog stays manageable.
   • Catalog is a projection of the ERP (notify-then-fetch, versioned listings); sales are reported back; identity & purchase eligibility come from gcstore.
   • Java 21 / Spring Boot (API) · Angular (SSR rendering service) · MariaDB.
4. GCruiter — production
   • Recruiting SaaS (web + API). Feature access driven by gcstore entitlement: web users authenticate via Keycloak; roles are projected by gcstore from purchased plans.
   • Java / Spring Boot · Angular · MariaDB.
5. GCflix — production
   • Video-on-demand platform, entitlement-gated per content item: gcstore issues tokens carrying the viewing session and a forensic watermark identity; GCflix owns media storage/transcode/serving.
   • Go · React 18 + Vite/TypeScript · MySQL · nginx media serving.
6. GCStocks Stream — pre-production
   • Real-time market-data backend (ticks, candles, fundamentals, news) — a multi-source aggregation hub with a subscription control plane. Foundation for capital-markets features (e.g. intraday valuation of open positions, integrated with the ERP).
   • Java 21 · Spring Boot WebFlux (reactive) · Maven monorepo (contracts / simulator / aggregator) · WebSocket→SSE.
7. ERP — the control plane — production
   • The operational control plane of the LLC: purchasing → inventory → sales → COGS → KPIs → fiscal close. Owns product truth (listings, options/variants, media library) and the financials.
   • Also the admin cockpit for gcstore (proxies its admin API) — including publishing the offers pushed to the Hub fleet.
   • Python / FastAPI · Angular · MariaDB.
8. Identity — Keycloak — production
   • Single customer identity provider (dedicated realm) for every web surface: OIDC Authorization Code + PKCE, one public client per app, single sign-on across the constellation.
   • Two-way sync with gcstore: gcstore owns the customer record; a custom Java event-listener SPI provider (built in-house) webhooks profile changes back in real time, with polling as backup and per-change history snapshots.
   • Keycloak · custom Java SPI provider jar.
9. Shared Data Plane
   • One MariaDB container serves the app schemas (GCruiter · GCflix · Shop · GCStocks), reached container-to-container over a shared Docker network — no host hop. The ERP and the core keep their own databases.

Platform conventions

• Trust boundary first: public clients are assumed hostile; entitlement is always decided server-side. Contracts live in a public repo and are the single source of truth per boundary.
• One server-side deploy pattern: Docker Compose per stack behind a host nginx that owns TLS; services publish loopback-only ports; every secret lives in an env file with fail-fast guards — never in git. Go services ship as distroless images.
• Client-side release pattern (Hub): tag-triggered GitHub Actions builds the release; the installed fleet self-updates.
• Typed data access (sqlc in Go, JPA in Java), versioned SQL migrations, append-only history where auditability matters.

---

Archive: the previous generation of this page — the DevOps Laboratory Portfolio (Combat Management System simulator: AIS/NMEA decoding, Kafka, AVRO contracts, Jenkins/SonarQube/Nexus pipelines) — remains available as the record of the Lab era.