Back to Projects & Case StudiesEnterprise CMS & Government Portal
Multi-Tenant Portal & Air-Gapped Kubernetes Deployment

Enterprise Government Portal CMS

Multi-tenant government portal and secretarial management platform with 20+ embedded modules, SSO integration, and air-gapped Kubernetes deployment serving 12+ agency units.

My RoleLead Full Stack Engineer & Platform Architect
Duration12+ Months (ongoing module development)
Deployment TierOn-Prem Air-Gapped
Confidential Enterprise System Notice

Sistem ini berjalan di kluster Kubernetes air-gapped milik infrastruktur TI internal dengan autentikasi SSO terpusat via django-allauth. Seluruh data pengguna, dokumen, dan workflow bersifat internal. Tidak ada demo publik — repositori bersifat private.

1. Context & Scope

Project Context

OrganizationEnterprise Training Organization
User Scale12+ Agency Units, 20+ Embedded Modules, Multi-Tenant Architecture
Team Composition1 Lead Engineer (architecture, backend, CMS, infra, DevOps)

Rebuilt a government agency portal from legacy Joomla into a modern Django-based multi-tenant CMS platform, consolidating 20+ embedded modules — from knowledge management and quiz engines to accreditation workflows and innovation galleries — all deployed on an air-gapped Kubernetes cluster with zero external SaaS dependencies.

2. Technical Constraints

Engineering Constraints

Operating under strict government air-gapped guidelines meant zero access to public cloud services (AWS/GCP/Azure), no third-party SaaS APIs, and strict validation against local SPBE cybersecurity standards.

  • Zero External Telemetry / 100% On-Premise Execution
  • Strict Data Sovereignty & Audit Traceability
  • Heterogeneous Legacy Database Interoperability
3. The Problem

The Challenge Before Intervention

Portal generasi sebelumnya dibangun di atas Joomla yang rentan terhadap celah keamanan (pernah ditemukan injeksi iklan di homepage). Selain itu, kebutuhan akan aplikasi kesekretariatan dan modul-modul insidental terus bertambah, sementara regulasi otoritas TI pusat melarang pembuatan common apps mandiri — semua harus terintegrasi dalam satu platform.

Portal Joomla legacy ditemukan celah keamanan berupa injeksi iklan — membutuhkan migrasi penuh ke platform yang aman dan terkontrol.
Kebutuhan insidental unit-unit organisasi (rekap keuangan, rekap kepegawaian, inovasi gallery, akreditasi) tidak bisa diwadahi sebagai aplikasi mandiri karena regulasi otoritas TI internal.
Arsitektur monolitik generasi kedua (Spring) susah dikembangkan — setiap penambahan fitur memerlukan restrukturisasi besar-besaran.
4. Architectural Decisions

Technical Choices & Rationale

Technologies & Infrastructure
Django 5.2 + Django REST FrameworkDjango Unfold (modern admin UI)HTMX + Alpine.js (frontend)PostgreSQL + MinIO (object storage)Redis + Celery (async tasks)Kubernetes + Docker (air-gapped)django-allauth (centralized SSO)

01. Django sebagai Fondasi CMS Multi-Tenant

Setelah kegagalan Spring generasi kedua (monolith yang susah dikembangkan), Django dipilih karena mature ecosystem-nya: django-allauth untuk SSO, django-import-export untuk migrasi data, django-unfold untuk admin UI modern, dan Django REST Framework untuk API. Struktur modular 'app-per-feature' memungkinkan 20+ modul hidup berdampingan tanpa coupling.

02. HTMX + Alpine.js untuk Interaktivitas Frontend

Menghindari kompleksitas SPA framework (React/Vue) untuk portal yang 80% kontennya adalah halaman informasi dan form admin. HTMX memberikan partial page updates tanpa full reload, Alpine.js untuk interaktivitas ringan — semuanya dirender server-side, nol build step, dan tetap terasa responsif.

03. MinIO Object Storage untuk Air-Gapped File Management

Tidak bisa menggunakan S3/Azure Blob di lingkungan air-gapped. MinIO menyediakan API S3-compatible on-premise untuk menyimpan dokumen, gambar CKEditor, dan file attachment modul — terintegrasi via django-storages dengan fallback ke local filesystem.

04. Arsitektur Modular 'App-per-Feature'

Setiap fitur (portal, akrab, quiz, akreditasi, event, file management, KM, inovasi gallery) adalah Django app terpisah di bawah folder app/. Hal ini memungkinkan pengembangan paralel, isolasi dependensi, dan onboarding modul baru tanpa menyentuh core portal.

// High-Level Architecture Topography

+------------------------------------------------------------------------------+
|                ENTERPRISE GOVERNMENT PORTAL CMS (AIR-GAPPED)                 |
|                                                                              |
|   +--------------------+          +--------------------------------------+   |
|   |  Browser (Internal)| -------> | Kubernetes Ingress (mTLS)            |   |
|   |  Government SSO    |          +--------------------------------------+   |
|   +--------------------+                         |                           |
|                                                  v                           |
|                                   +-----------------------------+            |
|                                   | Django 5.2 CMS Core          |           |
|                                   | - app_portal (public pages)  |           |
|                                   | - django-allauth (SSO)       |           |
|                                   | - django-unfold (admin)      |           |
|                                   +-----------------------------+            |
|                                     |              |             |           |
|                            +--------v----+  +------v------+ +----v---------+ |
|                            | 20+ Embedded|  | Celery/Redis| | PostgreSQL   | |
|                            | Modules:    |  | Async Tasks | | (Multi-      | |
|                            | - Quiz      |  | - Import    | |  Tenant)     | |
|                            | - KM        |  | - Export    | +--------------+ |
|                            | - Event     |  | - File Ops  |                  |
|                            | - Akreditasi|  +-------------+  +-------------+ |
|                            | - Inovasi   |                   | MinIO       | |
|                            | - Dashboard |                   | (S3-compat  | |
|                            | - File Mgmt |                   |  on-prem)   | |
|                            | - Akrab     |                   +-------------+ |
|                            | - Employee  |                                   |
|                            +-------------+                                   |
+------------------------------------------------------------------------------+
      
5. Results & Impact

Measurable Outcomes

Portal generasi ketiga berhasil menggantikan Joomla legacy dan Spring monolith dengan platform Django modular yang menampung 20+ modul terintegrasi. Sistem berjalan di kluster Kubernetes air-gapped dengan SSO terpusat melayani seluruh unit organisasi.

Migrasi penuh dari Joomla + Spring ke Django 5.2 — menghilangkan celah keamanan dan menyatukan portal CMS + aplikasi kesekretariatan dalam satu platform.

20+ modul terintegrasi: portal publik, knowledge management, quiz, akreditasi, event management, file management, inovasi gallery, dashboard, akrab, embed Tableau, dan lainnya.

SSO terpusat via django-allauth — autentikasi terpusat untuk seluruh pengguna tanpa manajemen kredensial terpisah.

Django Unfold memberikan admin panel modern dengan UX yang jauh lebih baik dibanding Django Admin standar — mempercepat operasional admin konten.

6. Visual Evidence & Sanitized Code

System Artifacts & Proof of Concept

Arsitektur Enterprise Portal — Multi-Tenant CMS Topology

Sanitized Artifact

Diagram arsitektur lengkap menggambarkan relasi antara Django CMS Core, 20+ modul embedded, PostgreSQL, MinIO, Redis/Celery, dan Kubernetes ingress.

Django Unfold Admin Panel — Content & Module Management

Sanitized Artifact

Modern admin dashboard berbasis Django Unfold untuk mengelola konten portal, pengguna, modul quiz, event, dan workflow kesekretariatan — menggantikan admin panel Joomla dan Django Admin standar.

[REDACTED INSTANCE DASHBOARD]STATUS: AIR-GAPPED ONLINE
Active Threads
2,048 rq/s
P99 Latency
18.4 ms
SPBE Audit Log
100% Immutable

Sanitized Code: SSO Integration via django-allauth

Sanitized Artifact

Konfigurasi autentikasi SSO terpusat menggunakan django-allauth dengan provider custom untuk identity provider organisasi.

# Sanitized: SSO Configuration with django-allauth
# settings.py

INSTALLED_APPS = [
    # Django Unfold admin
    "unfold",
    "unfold.contrib.filters",
    "unfold.contrib.forms",
    # Auth
    "django.contrib.auth",
    "allauth",
    "allauth.account",
    "allauth.socialaccount",
    # Custom SSO Provider
    "provider",  # app_provider — government SSO adapter
    # Portal modules
    "app_portal",
    "app_akrab",
    "app_employee",
    "app_quiz",
    "app_km",
    "app_event",
    "app_akreditasi",
    "app_innovation_gallery",
    "app_file_management",
    # ... 10+ other modules
]

AUTHENTICATION_BACKENDS = [
    "django.contrib.auth.backends.ModelBackend",
    "allauth.account.auth_backends.AuthenticationBackend",
]

# SSO Provider adapter (custom government SSO)
SOCIALACCOUNT_PROVIDERS = {
    "govsso": {
        "APP": {
            "client_id": env("SSO_CLIENT_ID"),
            "secret": env("SSO_SECRET"),
            "key": "",
        },
        "SCOPE": ["profile", "email"],
        "VERIFIED_EMAIL": True,
    }
}

ACCOUNT_EMAIL_VERIFICATION = "none"
LOGIN_REDIRECT_URL = "/dashboard/"
ACCOUNT_LOGOUT_REDIRECT_URL = "/"