Al Masum Nishat
Building high-throughput backend systems — from a real-time stock exchange order management system handling 1M+ concurrent connections, to open-source Laravel tooling used by other developers.
I'm a backend developer specializing in PHP/Laravel, Java, and Node.js, with a focus on systems that need to survive real load — financial messaging protocols, async processing at scale, and databases tuned for both speed and AI-driven search.
Recent work includes architecting a real-time OMS for the Dhaka Stock Exchange (FIX/ITCH protocols, Laravel Octane, 1M+ concurrent connections) and publishing open-source Laravel packages used by the broader PHP community.
Case studies
FiberMap — Fiber Optic Network Management SaaS
A multi-tenant SaaS platform for fiber optic ISPs to map physical network infrastructure, monitor devices via SNMP, and manage subscribers via RADIUS integration.
Order Management System — Real-Time Trading Platform for Stock Exchanges
An order management system for brokerage houses and stock exchanges that executes trades over live FIX and ITCH protocol feeds while enforcing multi-level risk controls.
Shaivo — On-Demand Home & Commercial Services Marketplace
A multi-sided marketplace connecting customers with vetted service vendors through subscription bundles, one-off orders, and a full task-assignment workflow.
WinInterview — AI-Powered Job Interview & Resume Prep Platform
A headless, API-first SaaS backend that helps job seekers build resumes, generate cover letters, and practice mock interviews using an external AI microservice, with full subscription billing and an affiliate program built on top.
Problem
Fiber ISPs need to track physical infrastructure (cables, splices, conduits, core capacity) alongside the network devices and subscribers that run over it, and to see the two connected — so that when a cable breaks, the system can tell them which customers and devices are actually affected, rather than treating mapping and monitoring as separate tools.
What I built
I built a Laravel 13 / PHP 8.4 multi-tenant SaaS application where each organization gets an isolated subdomain with data scoped through global Eloquent scopes. The core is an interactive fiber map (rendered on both Google Maps and Leaflet) for drawing cables, placing locations and devices, and tracing fiber cores, paired with an SNMP polling pipeline for device monitoring, a RADIUS integration for live subscriber and session data, and a fault-localization engine that correlates disconnects back to physical cable segments. Billing runs through Stripe/Cashier with trial enforcement, and live map updates are pushed to connected users over RabbitMQ Web MQTT.
Fiber Mapping & Core Trace
The map supports freehand and two-click cable drawing, a symbol library with custom SVG/PNG markers and per-org auto-seeded defaults, hierarchical location categories with filtering, and cable properties covering type, infrastructure type (aerial/underground/indoor), and conduit grouping. Fiber core trace does a downstream recursive walk from any point, highlights the path on the map, and exports to Excel or PDF; a companion connection-path modal does the reverse — an upstream walk from any location with multi-route support. OTDR break-point support accepts manual distance entry or .sor file import, running a BFS path-find to place event markers and build a trace graph with power budget calculations. A feasibility-check tool lets a user click any map point to see cables and locations within a configurable radius along with free core capacity and distance.
SNMP Monitoring Pipeline
Device monitoring runs on a scheduled pipeline: snmp:poll dispatches a queued job every 5 minutes per SNMP-enabled device, walking interfaces via snmp2_walk/snmp3_walk, upserting interface metadata, inserting raw 64-bit octet counters, calculating bps, and rolling up to 5-minute and hourly traffic aggregates (snmp:rollup-hourly) stored in daily PostgreSQL partitions (snmp:create-partitions). The monitor dashboard shows five summary cards (total/SNMP/IP/interfaces/up-interfaces) with collapsible device cards and lazy-loaded Chart.js traffic charts, switchable between live 24h, 1h/7d, and 1h/30d ranges, updated live via MQTT. Polling can run directly from the server or through an on-site agent for devices on private networks.
RADIUS Integration & Fault Localization
The platform ingests RADIUS authorize, post-auth, and accounting events through dedicated API endpoints, building a live PPPoE subscriber table (online/offline status, framed IP, NAS, last seen) and a session table with gigaword-corrected 64-bit byte counters. A DetectMassDisconnect job watches for RADIUS Stop-event spikes indicating a mass disconnect, and a FaultClusteringService runs a BFS upstream path walk to cluster affected subscribers back to a suspect cable or location, surfacing them in a fault-event list with SNMP correlation and a resolve workflow. A DiagnosticEngine runs a 4-step RADIUS + fiber + SNMP chain to produce a diagnostic report for an individual subscriber.
Multi-Tenant SaaS & Billing
New organizations register through a single atomic transaction that slugifies the org name into a subdomain, creates the organization and owner user, starts a 14-day trial (via a Cashier Stripe subscription or a local trial_ends_at field), and assigns the org_admin role. A RequireActiveSubscription middleware gates every authenticated request on the subdomain, redirecting expired trials to billing while leaving the billing page itself always accessible. Org admins can upgrade/downgrade plans or manage their subscription through the Stripe Billing Portal, with Cashier handling renewal webhooks. Superadmins get a separate view across all organizations' billing status, plans, and device usage.
Real-Time Collaboration & Offline Support
Location and cable changes broadcast live to all connected users over RabbitMQ Web MQTT, with per-user and org-level toggles to control who receives updates. The app is also installable as a PWA with a service worker, and supports a full offline map backed by an IndexedDB data cache and cached OSM tiles, falling back automatically to Leaflet when needed and reloading fresh data once back online.
Platform Administration
Org-level admin tools cover location/cable/device management tables with search and filtering, custom role and permission CRUD (via Spatie), member invitations with per-member live-update toggles, agent token generation for on-site polling agents, and SSO via Google Workspace, Microsoft Entra ID, and LDAP/Active Directory. A built-in support-ticket system handles faults, installs, maintenance, and inspections with a role-based assignment hierarchy, P1–P4 SLA auto-targets, and a 30-minute pre-breach warning, viewable as Kanban or table. Notifications combine a database inbox with filter tabs and browser push via Web Push/VAPID.
Highlights
- Downstream core trace and upstream connection-path walking both implemented as graph traversals over the same cable/location data, exported to Excel and PDF
- SNMP pipeline storing raw counters in daily PostgreSQL partitions, rolled up to 5-minute and hourly traffic aggregates
- Fault clustering that turns a spike in RADIUS Stop events into a located, ranked list of suspect cable segments via BFS graph traversal
- Multi-tenant architecture with per-org subdomains, Stripe-backed trial/billing enforcement, and org-scoped Eloquent global scopes
- Real-time collaborative map updates over RabbitMQ Web MQTT, with full offline-first support via IndexedDB and cached map tiles
Problem
Brokerage houses and stock exchanges needed an order management system that could place and manage trades over the FIX protocol, consume live market data over the ITCH protocol, and enforce risk limits before any order reached the exchange, while supporting administrators, traders, and investors as separate user roles on the same platform.
What I built
I built the system as a Laravel 12 backend paired with Java microservices that handle the FIX 5.0 SP1 and ITCH 4.0 protocol connections. The Laravel side covers order lifecycle management, portfolio and position tracking, commission calculation, and role-based access for admins, traders, and investors, while PostgreSQL stores the transactional data and Redis handles caching, sessions, and pub/sub messaging.
Microservices Architecture
The protocol handling was split into three standalone Java services rather than embedded in the PHP application:
oms-fix-1.0.1.jar— implements FIX 5.0 SP1, managing exchange sessions, heartbeats, sequence numbers, automatic reconnection/failover, and message queuing with retry logicoms-itch-1.0.0.jar— parses the ITCH 4.0 feed, streaming real-time market data across multiple channels (TV, Index, News) with message filtering and routing for high-throughput processingoms-broadcast-1.0.0.jar— a WebSocket server that distributes real-time data to connected clients, handling connection pooling, message compression, and reconnection
Order Management
The system supports the full order lifecycle over FIX: new order, cancel request, and cancel/replace, plus off-market trade execution and multi-exchange routing (DSE primary). Order types include market, limit, stop, and stop-limit orders, with day, GTC, IOC, and FOK time-in-force options. Order status is tracked through the standard FIX states (Pending New, Partially Filled, Filled, Canceled, Replaced, Pending Cancel, Rejected, Expired). Additional order-handling features include a panic-mode emergency cancel-all, pre-market order queuing, automatic retry on temporary failures, and batch order submission.
Portfolio & Risk Management
Portfolio tracking covers current holdings with real-time valuation, average purchase price, and realized/unrealized P&L, with position tracking across T+0, T+1, and T+2 settlement and reconciliation against the exchange. Risk management is enforced through multiple limit types — cash, deposit, margin ratio, max capital buy/sell, and total/net transaction limits — checked pre-trade alongside fund sufficiency, margin requirements, short-selling validation, and duplicate order detection.
Background Processing
A set of Laravel queue jobs handles asynchronous and scheduled work: importing client and position data from the exchange (ImportDSEClient, ImportDSEPosition), exporting trade confirmations and end-of-day ticker data (ExportTrades, ExportEODTicker), asynchronous FIX message processing (FixJob), and database backup/restore. Scheduled tasks handle market open/close automation, end-of-day settlement, limit resets, and portfolio reconciliation.
Security & Compliance
Access control is role-based (admin, trader, investor), with API authentication via Laravel Sanctum, OTP-based two-factor authentication, and session timeout controls. All FIX messages are logged, alongside a full audit trail of user actions, IP addresses, and session activity, supporting BSEC regulatory reporting for the Dhaka Stock Exchange.
Highlights
- Three independent Java microservices for FIX order execution, ITCH market data parsing, and WebSocket broadcasting, decoupled from the PHP application
- Pre-trade risk engine covering fund, margin, position, and duplicate-order checks before routing to the exchange
- T+0/T+1/T+2 settlement tracking with automated portfolio reconciliation against the exchange
- Full FIX message logging and audit trails built in to support BSEC regulatory reporting
- Data model spans 50+ Eloquent models across 70+ PostgreSQL tables, with Redis-backed queues for asynchronous processing
Problem
Home and commercial service businesses (cleaning, lawn care, handyman, pool service, and more) are typically booked one-off through separate vendors, with no unified way for a customer to bundle recurring services, for a vendor to manage incoming work, or for a platform operator to take a margin on the transaction. Shaivo needed a marketplace that could handle subscription-based service bundles, one-time orders, vendor vetting, and the full lifecycle of a task from booking to completion.
What I built
I built a Laravel 12 marketplace platform with three roles — Admin, Vendor, and Client — managed through Spatie Permission. Customers subscribe to pre-defined or custom service bundles via Stripe Checkout/Cashier, or place one-time orders; those subscriptions and orders generate tasks that get assigned to vendors and tracked through a full status workflow with GPS-tagged updates. The platform also includes vendor KYC and approval, a review/rating system, a complaint/ticket system, in-app and push notifications, and an admin panel for user, role, and platform configuration management.
Service Catalog & Membership Bundles
The catalog is organized into hierarchical service categories, individual services (with base pricing, duration, complexity level, and safety guidelines), and vendor-specific service variants with custom per-vendor pricing across weekly/monthly/quarterly/yearly tiers. On top of that sit pre-defined membership bundles for both residential and commercial customers, priced as tiered plans:
- Residential: Individual single-service plans ($49–$129/mo), Renters ($159/mo), Snowbird ($179/mo), Home Essential ($249/mo), Home Premium ($399/mo), and Home Elite ($499/mo), each bundling a fixed set of cleaning, lawn, handyman, pet-care, and pool services at increasing frequency and priority.
- Commercial: Small Business ($349/mo), Commercial Pro ($599/mo), Property Manager (per-unit pricing starting at $199/unit/mo with volume discounts down to $159/unit), and Enterprise ($1,199/mo).
- Every plan supports an optional Pool Service add-on, and customers can also build fully custom bundles by selecting individual services and variants.
Each plan carries a fixed 85/15 revenue split — vendors are paid 85% of the plan price and the platform retains 15% — which is calculated per plan and enforced through the subscription and payout logic.
Vendor Onboarding & Verification
Vendors register with company details, business registration number, tax ID, and service-area coverage, then move through a pending → approved/rejected/suspended workflow that admins control. KYC documents (business license, tax certificate, insurance) are uploaded and verified individually, with verification status tracked per document. Once approved, vendors define their own service variants, pricing, and worker/team details, and their aggregate rating and completed-service count are tracked and displayed.
Subscriptions & Billing
Bundle subscriptions run through Stripe Checkout and Laravel Cashier, supporting multiple billing frequencies, trial periods, and locked-in pricing at the time of subscription. Customers can cancel (at period end) or resume a subscription, and swap services within an active subscription without cancelling it. A queued GenerateSubscriptionOrderJob automatically creates orders on each billing cycle based on the subscription's frequency, and Stripe webhooks drive subscription-status updates, invoice generation, and payment success/failure handling. Invoices are viewable in-app and downloadable as PDFs.
Orders & Task Lifecycle
Orders (one-time, subscription-generated, or emergency) carry a status workflow from pending through assigned, in-progress, completed, and cancelled, with multiple services and variants attached per order. Each order generates one or more tasks assigned to a vendor and, optionally, a specific worker. Tasks move through a detailed status chain — pending, accepted, en route, started, completed, cancelled — with support for schedule negotiation between vendor and client (either side can propose a time, and the other approves or rejects it). Every status change is recorded as a task update with a GPS coordinate, a note, and the user who made the change, giving a full audit trail per task.
Reviews, Support & Notifications
After a task completes, customers can leave a 1–5 star rating and written review, which admins moderate before it affects a vendor's aggregate rating. A complaint/ticket system covers categories like service quality, billing, and scheduling, with priority levels and a status workflow from open through resolved/closed, and can be linked back to the originating order or task. In-app notifications cover events like booking confirmations and payment updates, with read/unread tracking and web push subscription support.
Admin Panel & Access Control
Admins manage users (create, edit, deactivate, soft-delete, role assignment), custom roles and permissions via Spatie Permission, platform-wide configuration keys (typed as string/number/boolean/JSON/URL), vendor approval and document verification, review moderation, and contact-form submissions from the public site — all with search, filtering, and pagination.
Public Website & Design System
The public-facing site includes a marketing home page, service and bundle catalogs with search/filter, legal pages (Terms, Privacy, Cookie Policy, GDPR/EU policies), and a cookie-consent system. The frontend is built on a shared Blade component library (form inputs, buttons, cards, alerts, badges, modals, sidebars) styled with Tailwind CSS v4, with system-wide dark mode, responsive layouts, and WCAG AA accessibility considerations (focus states, ARIA attributes, keyboard navigation).
Highlights
- Full subscription-to-task pipeline: Stripe subscription → automatic order generation → task assignment → GPS-tracked status updates → completion → review
- Bidirectional schedule negotiation between vendors and clients built into the task status workflow, not bolted on afterward
- Fixed 85/15 vendor/platform revenue split modeled across 11 distinct residential and commercial membership tiers plus a customizable bundle path
- Vendor KYC and document verification workflow gating marketplace participation, independent of the general auth/role system
- 22 Eloquent models and 35+ controllers organized around four core domains — catalog, subscriptions/billing, orders/tasks, and marketplace trust (reviews, complaints, vendor verification)
Problem
Job seekers need help producing a strong resume, a tailored cover letter, and practice for interviews — including live-coding technical rounds and spoken answers, not just text Q&A. Building this meant orchestrating calls to a generative AI engine asynchronously (since generation isn't instant), persisting structured results, gating access by subscription tier, and giving users real-time visibility into job status, all without the API backend itself hosting any AI models.
What I built
I built WinInterview as a headless Laravel 12 API backend (no bundled frontend — the actual UI is a separately deployed SPA talking to this API over Sanctum stateful cookies). The app doesn't run AI models itself; it orchestrates calls to a separate external AI microservice over HTTP, webhook, or MQTT, tracks every job through a task-queue lifecycle, and persists validated AI output into structured resume, cover-letter, and mock-interview records. On top of that sits a full monetization layer — dual billing rails (Stripe and Paddle), usage-based feature quotas, coupons and add-on packages — plus an affiliate/referral program with wallet-based payouts.
AI Orchestration Architecture
AI requests flow through a queue-based pipeline rather than a direct synchronous call. An AIController accepts a file upload, a URL, or raw text/JSON interchangeably, converting uploaded documents (doc/docx/rtf/odt/txt/html, images, PDF) into usable input, then dispatches a ToAI job onto the queue. That job routes to one of four pluggable transport strategies depending on the AI_EXEC_TYPE config: a synchronous-style REST POST, a webhook flow (HTTP POST now, AI service replies later via callback — the transport configured by default), or MQTT pub/sub for real-time/streaming; a fourth socket-raw transport is referenced but not yet implemented. Every transport extends a common AIJobService base that builds a task-specific payload, writes a full request/response audit log, and creates a TaskQueue record moving through started → pending → completed/error. Status updates are pushed to a Redis list keyed by the user's email, which bridges into the MQTT broker for real-time frontend notifications. When the AI service calls back with a result, it's validated against typed rule sets in an AIValidationService before being persisted — guarding against malformed or hallucinated output reaching the product.
AI-Powered Career Tools
The platform exposes AI Resume Builder (from an uploaded CV, from scratch via structured JSON, or from a prior analysis), an ATS-style Resume Analyzer that scores a resume against an optional job description, an AI Cover Letter Generator, and an AI Mock Interview system that generates multi-round question sets (HR, technical, behavioral) and gives per-question feedback. Mock interview answers can be submitted as text, code/document, or a voice recording (mp3/wav/webm), with some questions flagged for a live code editor — genuine spoken interview practice rather than just text Q&A. A Resume Section Enhancement endpoint lets users request a targeted AI rewrite of a specific section based on their own feedback, and resumes are built from structured sub-resources (skills, education, experience, projects, languages, hobbies) rather than freeform text blobs. Markdown/HTML content can also be exported directly to PDF via Pandoc and wkhtmltopdf.
Monetization Engine
Billing runs on two rails: Stripe via Laravel Cashier as the primary path (full Checkout session flow, plan swap/cancel/resume, hosted invoice PDFs), and Paddle as a secondary Merchant-of-Record rail with its own webhook handling and signature verification, likely for international VAT/tax compliance. A StripeService::createPackage() method lets admins define pricing entirely inside the app's own database and have it auto-provision the corresponding Stripe Products and recurring Prices — no manual Stripe Dashboard work required — and the public pricing page pulls its catalog live from Stripe. Feature access is gated by a VerifyPackageSubscribed middleware that reads per-feature quotas out of each package's JSON features field (a numeric cap or "Unlimited"); if a user holds multiple active packages, quotas for the same feature pool together, and a user's very first use of any AI feature is allowed free even with zero active packages, as a try-before-you-buy funnel. Usage is metered by counting actual records created since the oldest active package's start date rather than a separate counter table, avoiding drift. Add-on packages allow standalone à la carte purchases, and coupons support percent or fixed-amount discounts.
Affiliate & Referral Program
Affiliates earn a percentage or fixed commission (set per-affiliate by an admin), tracked through a wallet ledger (wallet_histories) recording every received/sent transaction. Affiliates can request withdrawals, which go through a pending/approved/rejected/neutral workflow, and manage their own payout method and coupon codes for tracking referrals — a standard commissionable SaaS referral mechanic built directly into the platform rather than bolted on via a third-party tool.
Data Model & Access Control
The schema spans 53 migrations covering identity, resume-builder data, AI outputs, monetization, and content/compliance. Role-based access control goes beyond typical resource-level permissions: role_permissions scopes a permission to a specific role, permission, table, and column, supporting fine-grained admin sub-roles (e.g., a support role that can view but not edit billing columns). Two roles are active today — admin and applicant — with affiliate and guest roles scaffolded in the seeder but not yet enabled. Product/UX details point to an initial Bangladesh/South Asia target market (father's/mother's name and religion fields on the CV profile model, a Division/District/Upazilla administrative-geography schema), while SSO across Google, Microsoft, and LinkedIn plus JSON-based multi-currency pricing keep the architecture open to broader markets without a re-architecture.
Admin & Content Management
The admin back-office covers subscription management, a nested key/value settings tree, a full blog + blog-category CMS for SEO content marketing, testimonials, affiliate commission configuration, role/permission management, wallet withdrawal approval, and resume template management. Public-facing pages include pricing, privacy policy, terms, a cookie-consent manager with essential/marketing/analysis consent flags, and public resume/template browsing.
Highlights
- Four pluggable AI transport strategies (REST, webhook, MQTT, and a planned socket-raw) behind a single job abstraction, so the AI backend can be swapped or scaled independently of the orchestration layer
- Full task-queue lifecycle tracking with Redis-to-MQTT bridging gives end users real-time status on long-running AI jobs, not just a spinner
- Column-level RBAC (
role_permissionsscoped to role + permission + table + column) rather than typical resource-level permission checks - Admin-driven Stripe product/price provisioning — pricing changes flow from the app's own database into Stripe automatically, with no manual dashboard work
- Dual billing rails (Stripe + Paddle) and a self-service affiliate/wallet payout system built directly into the platform
- Voice-based mock interview answers with live-coding question support, not just text-based Q&A
Packages other developers use
__('messages.welcome')
// missing key → auto-translated,
// cached to lang file, never called again
Writing
View all posts →
How to Create a Custom Domain Email Without Running a Mail Server
Set up incoming forwarding and authenticated outgoing SMTP using Cloudflare Email Routing, Gmail, and SMTP2GO — eliminating VPS mail server overhead.
Why We Chose Laravel Octane for a 1M-Connection OMS
PHP-FPM couldn't hold persistent connections at exchange scale. Octane's long-running worker model changed the math.
Building laravel-tagging: Polymorphic Tags Without the N+1
How a general-purpose tagging package hits sub-100ms p99 latency at a million tags per model, and the indexing tricks that got it there.
Parsing FIX and ITCH in the Same Order Pipeline
FIX is session-based and human-readable; ITCH is a raw binary multicast feed. Here's how we normalized both into one order lifecycle.
Auto-Translating Laravel Language Files with Gemini
Why I built laravel-ai-translator - generate missing translation strings once via the Gemini API, cache them to disk, and never call the API again.
pgvector in Production: Lessons from a Real Search Feature
Adding embedding-based search to an existing PostgreSQL database instead of standing up a dedicated vector store.
Other work
What I work with
Timeline
Let's talk
Open to backend/systems roles and interesting technical problems. Fastest way to reach me is email — the form below works too.