Bicitra Commerce
Product Architect / Lead Engineer
A self-hosted eCommerce platform: each merchant gets their own isolated Laravel/MySQL installation on shared or VPS hosting, distributed as installable release packages and kept up to date through a self-built, zero-downtime update pipeline.
Problem
Merchants who want their own store are usually stuck choosing between a SaaS platform's fees and limits, or self-hosted software that's hard to keep safely updated and hard to customize without forking core. Bicitra Commerce is built to be installed per-merchant on the cheapest available hosting, stay safely updatable long after launch, and support store-specific features without anyone touching core code.
Approach
A domain-driven Laravel 11 app — Catalog, Orders, Customers, Discounts, Payments, Shipping, Themes and Updates each isolated under app/Domain/ rather than living in fat controllers. Blade handles page structure and SEO-critical markup; Vue 3 components mount inside those views for the interactive pieces (cart drawer, gallery zoom, variant selection) — deliberately with no Node.js process required in production, since assets are precompiled via Vite. A separate companion app, the "hub," acts as landlord to every individual storefront install: issuing licenses, hosting release packages, and pushing core and template updates out to stores over HTTP.
A hard problem I solved
The hard problem was shipping updates to production software running on hosts I don't control. Most installs run on cPanel shared hosting, where symlink() can be disabled outright and file ownership can end up inconsistent after a manual composer install — with no ops team to step in if an update goes wrong. The update pipeline now preflights every file write before the site goes down, so a permission problem is caught and reported with zero files touched instead of discovered mid-update; verifies each release package against a checksum before applying it; skips replacing vendor/ entirely when dependencies haven't changed; and rolls back completely on failure, including removing new top-level files a failed update had already added. That preflight check exists because of a real case: a host where vendor/ had been left owned by the SSH user after a manual composer install — first found the hard way, mid-update, with the site down.
Status
Currently launching. Built solo from the initial commit through a working self-update pipeline, a two-theme storefront, and a sandboxed extension system (extensions boot inside their own try/catch and auto-disable after three consecutive failures, so a bad one can't take a storefront down) in about a month of focused engineering. Not yet at scale — the safety mechanisms were built ahead of the first paying merchant, not retrofitted after something broke.
Technology
- Laravel
- PHP
- Blade
- Vue 3
- Tailwind CSS
- MySQL
- Docker
- Vite
Currently launching — product link coming soon.