Green Work — Task & Delivery Platform
A self-hosted, product-agnostic work-management platform with realtime boards, RAID risk tracking and a tamper-evident audit log.
- Role
- Contributor
- Team
- XEOO team
- Timeline
- Sep 2026 – Ongoing
- Organisation
- Green Compare Ltd (XEOO team)
- Code
- Proprietary (employer)
- Reading time
- 2 min
Projects, issues, boards, roadmaps, risk registers, reports, documents and an AI suite in one self-hosted stack: Next.js 16 on the front, FastAPI for the domain, a Go service fanning Postgres events out over Server-Sent Events. Built by the XEOO team.
Overview
Teams were tracking delivery across tools that didn't talk to each other. Green Work brings projects, issues, risks, documents and reporting into one self-hosted platform that the company runs on its own infrastructure.
The problem
- Delivery work, risks and documentation lived in separate tools.
- Changes needed to reach everyone's screen instantly, without polling.
- Every change had to be auditable — and the audit trail itself verifiable.
Context & constraints
The platform is product-agnostic: the same stack serves any team's projects. It runs as six services on one Docker network, with a reverse proxy as the only container that binds host ports, so it can never collide with other services on a shared machine.
Approach
- Projects & issues — epics, stories, tasks, bugs, spikes, risks and chores with priorities P0–P3, story points, due dates, labels, dependencies and
PROJECTKEY-SEQticket keys. - Board & backlog — eight statuses from backlog to done (plus blocked and won't-do), milestones and a roadmap.
- Risk — a 5×5 likelihood × impact heatmap and a RAID register.
- Reports — rework, cumulative flow, release readiness, traceability and sprint burndown.
- Trust — a hash-chained, independently verifiable audit log and a dynamic RBAC catalogue of 35 permissions.
- Documents & import — an in-app handbook plus CSV, XLSX, PDF, DOCX, Markdown and image import with OCR and AI, through a parse → review → commit flow.
- AI suite — draft issues, epic breakdowns, project reports, summaries, stand-ups and board-aware chat — dormant until a key is configured.
- Integrations — HMAC-signed outbound webhooks with retries, personal API keys and email with a delivery outbox.
Key capabilities
- Realtime boards over Server-Sent Events
- Hash-chained, verifiable audit log
- Dynamic RBAC with a 35-permission catalogue
- 5×5 risk heatmap and RAID register
- OCR + AI import with human review before commit
- Signed webhooks and personal API keys
Architecture
Edge
Services
Data
The API writes and notifies; a small Go service listens to Postgres and streams events to every open browser. Select a component to trace its connections.
Key decisions
ADR-01Postgres as the event bus
- Context
- Realtime updates usually mean adding a message broker to run and monitor.
- Decision
- Emit NOTIFY inside the same transaction as each change; a Go service LISTENs and streams to browsers over SSE.
- Trade-offs
- No extra infrastructure and no events for rolled-back changes; fine at team scale.
ADR-02Store only hashes of tokens
- Context
- Refresh and password-reset tokens are as good as passwords if the database leaks.
- Decision
- Persist only SHA-256 hashes of refresh and reset tokens, and rotate refresh tokens on use.
- Trade-offs
- Tokens cannot be shown again — by design.
Quality & delivery
Testing
CI runs backend and web checks plus an edge integration job that exercises the proxy routing.
Deployment
Images are built in CI and pulled onto the host; the production variant runs five containers behind the host’s own web server.
Outcome
- Services in the stock stack
- 6
- Proxy, web, API, realtime, database, storage
- Permissions in the RBAC catalogue
- 35
- Starter and custom roles
In use internally for planning and delivery tracking.
Lessons
- The database you already run can often be your message bus.
Building something similar?
Tell me what you’re working on — I reply to every serious message.
Related work
Green Compare CRM
A FastAPI modular monolith with a React 19 front end, where Postgres row-level security backs every permission check. I started the repository, then shipped features across finance, telesales, renewals, dashboards and access control.
- TypeScript
- Python
- React
- Ant Design
- TanStack Query
- FastAPI
- +9