All case studies

Case study 08 / 19

NR-CSR Program, Approval & Payment Management

Corporate social responsibility management system: proposal intake, eligibility, multi-level evaluation and survey approvals, budgets and work programs, payment requests exported to the group payment platform, vendor and legal documents, and reporting. Modernised from Laravel 6 on Oracle to Laravel 8 on PostgreSQL 16.

Stack
PHP 7.4 · Laravel 8 · PostgreSQL · Blade · LDAP · PHPStan · PHPUnit · Docker · Nginx · IIS
NR-CSR budget monitoring dashboard with annual budget, realisation and remaining budget, split by SDG pillar and priority

The problem

CSR at Nusantara Regas runs through a long chain: a proposal is checked for eligibility, evaluated, surveyed and approved level by level up to the CEO, then funded from annual budgets and work programs, paid in instalments through the group's POPAY payment platform, and reported per pillar and SDG. The existing application carried that chain on Laravel 6 against an Oracle database that was being retired, with no static analysis, no CI, and production on an offline IIS server where every deployment was manual and risky.

What I built

I own NR-CSR end to end. I upgraded the framework from Laravel 6 to 8, migrated the schema and every environment from Oracle to PostgreSQL 16 and removed the Oracle driver, and restructured the code into Form Requests, Actions and Services behind domain route files with role middleware. I kept the Indonesian domain model and its 68 Eloquent and read-only view models intact, hardened authentication with LDAP fallback and email OTP, added liveness and dependency health endpoints for monitoring, and built the in-app user manual from screenshots of a test-seeded instance. The quality bar now runs in CI: a hardcoded-secret guardrail, PHPStan level 5, PHP-CS-Fixer and P0 to P2 regression suites on PHP 7.4 and 8.1.

In use

Realisation list recording donations and contract instalments with reference numbers, recipients, amounts and evidence
Realisation list recording donations and contract instalments with reference numbers, recipients, amounts and evidence
Work program planning page with the annual budget, allocated program budget and remaining budget
Work program planning page with the annual budget, allocated program budget and remaining budget
Monitoring and evaluation page listing program documents, evaluations and periodic reports per work program
Monitoring and evaluation page listing program documents, evaluations and periodic reports per work program

Architecture

Users reach the Laravel 8 application through IIS in production or nginx in Docker. Requests flow from domain route files and role middleware through Form Requests, Actions and Services to Eloquent models on PostgreSQL 16. POPAY, LDAP, SMTP and a monitoring client sit outside, and the green band is the modernisation work that moved the system off Laravel 6 and Oracle.

NR-CSR architecture: inputers, approvers, finance, legal and subsidiary users reach a Laravel 8 application on PHP 7.4 behind IIS or nginx, structured as routes and middleware, authentication with LDAP fallback and OTP, controllers with Form Requests, Actions and Services, Eloquent models and reporting, on PostgreSQL 16 with POPAY, LDAP, SMTP and monitoring integrations, plus a band of modernisation work

Open the image for full size

Proof

  1. 01 Laravel 6 to 8 upgrade and Oracle to PostgreSQL migration delivered in October 2026 as the first steps of a written dependency-hygiene plan, with the schema conversion tooling kept in the repository.
  2. 02 Layered request pipeline: domain route files, login and inactivity-timeout middleware, narrow role aliases such as isAdmin, isApprove, isFinance, isLegal and isSubsidiary, 83 Form Request classes and single-purpose Actions and Services.
  3. 03 POPAY integration through a Guzzle wrapper: payment requests are created and listed per approved proposal and the platform calls back a status endpoint; JSON responses share one envelope with centralised exception mapping.
  4. 04 Reporting through 34 Excel export classes, DataTables grids and printable views, plus dashboards by pillar, priority and program for budget monitoring.
  5. 05 Two deployment shapes from one codebase: nginx, PHP-FPM and PostgreSQL in Docker for development and CI, and an offline IIS child application with PHP FastCGI for production.
  6. 06 Guardrails on every push: secret scan, PHPStan with Larastan, PHP-CS-Fixer and the critical regression suites, with a PHP 8.1 validation runner alongside the 7.4 baseline.

Result

The platform now runs on a supported framework and a single database engine across local, container and production environments, with every deployment reproducible from the repository. Finance exports payment requests straight to POPAY instead of re-keying them, and the October 2026 releases simplified realisation per instalment so donations and contract payments are recorded once, with their evidence, and flow into the recap reports without re-entry.