Trueque Admin & Auth
Internal admin portal and Keycloak identity infrastructure for Trueque — tenant onboarding, DIAN certificates, and subscriptions.
Problem
Define the core challenge
Problem
Operating a multi-tenant Colombian e-billing SaaS required internal tooling to onboard companies, manage DIAN digital certificates per tenant, govern subscriptions, and provide a secure centralized identity layer — separate from the merchant-facing product experience.
Insight
Provisioning per-tenant DIAN certificates through admin UI and S3; keeping RBAC defaults synchronized between admin portal, backend Liquibase seeds, and merchant app permission catalogs; securing Keycloak deployments with TLS, persistence, and environment-specific realm configuration; coordinating test/prod promotion across admin, auth, backend, and frontend services.
Target
Design a system that improves speed, usability, and delivery confidence without adding maintenance overhead.
Process
How the work was executed
Discover
Companion platform to Trueque merchant app: a Next.js 14 internal admin portal for company provisioning, DIAN certificate upload to S3, subscription lifecycle management, and RBAC alignment — plus Keycloak 26 infrastructure-as-code with custom login theme, nginx TLS termination, and centralized OIDC authentication for the entire Trueque ecosystem.
Build
Built trueque-admin (Next.js, Prisma, NextAuth with Azure AD and Keycloak credentials) for platform operations and trueque-auth (Keycloak 26 + custom theme + nginx/Certbot) for OIDC infrastructure — integrated with the Spring Boot backend and Angular merchant app through shared environment conventions and GitHub Environment deploy pipelines.
Validate
Provisioning per-tenant DIAN certificates through admin UI and S3; keeping RBAC defaults synchronized between admin portal, backend Liquibase seeds, and merchant app permission catalogs; securing Keycloak deployments with TLS, persistence, and environment-specific realm configuration; coordinating test/prod promotion across admin, auth, backend, and frontend services.
Solution
Translate constraints into a scalable solution
Process
Companion platform to Trueque merchant app: a Next.js 14 internal admin portal for company provisioning, DIAN certificate upload to S3, subscription lifecycle management, and RBAC alignment — plus Keycloak 26 infrastructure-as-code with custom login theme, nginx TLS termination, and centralized OIDC authentication for the entire Trueque ecosystem.
Solution
Built trueque-admin (Next.js, Prisma, NextAuth with Azure AD and Keycloak credentials) for platform operations and trueque-auth (Keycloak 26 + custom theme + nginx/Certbot) for OIDC infrastructure — integrated with the Spring Boot backend and Angular merchant app through shared environment conventions and GitHub Environment deploy pipelines.
Architecture
Next.js admin portal with Prisma for platform metadata and NextAuth bridging Azure AD + Keycloak for operator access; Keycloak 26 deployment (trueque-auth) with custom theme and external PostgreSQL persistence issues OIDC JWTs with company_id claims consumed by Spring Boot and Angular clients; coordinated four-repo deploys on AWS Lightsail via GitHub Environments.
Results
Ship measurable outcomes
Results
Operational internal admin for tenant onboarding and certificate management at admin.trueque.pro; centralized Keycloak auth at auth.trueque.pro; automated test deploys from main and tag-based production promotion across the Trueque platform stack.
Impact
Business and product teams gained better reliability, clearer UX behavior, and a stronger foundation for iteration.
Next
The system now supports future features with less rework and more predictable frontend execution.
Tech stack
- Next.js 14
- React 18
- Keycloak 26
- Prisma
- NextAuth
- Tailwind CSS
- Zod
- AWS S3
- Nginx
- Certbot
- GitHub Actions
- TypeScript