A production-grade double-entry payment ledger in Go, built in public over 14 weeks and deployed live at go.sohag.pro.
The core invariant: every transaction is two or more postings that sum to zero per currency, enforced in the domain type and a Postgres CHECK trigger. Balances are derived from an append-only posting history, never stored.
What's in v1.0.0
- Atomic posting under
SERIALIZABLE+ retry, stress-tested under heavy contention - Mandatory idempotency keys with a bounded replay window
- A tamper-evident, hash-chained audit log with signed off-box anchors
- REST + gRPC over one shared domain core (RFC 7807 errors, generated OpenAPI)
- Multi-currency + FX: env rates or a free live feed with a staleness guard, USD-hub triangulation, per-currency clearing accounts
- Account hierarchy + rollup reporting, trial balance (the zero-proof)
- Approval workflows with real per-key four-eyes (maker-checker)
- In-DB outbox event stream + signed, SSRF-guarded, at-least-once webhooks (no Kafka)
- Per-tenant Postgres RLS, PII crypto-shredding
- OpenTelemetry traces +
slog+ Prometheus - VPS deploy on push: migrate-before-swap, health-check, rollback
The record
27 ADRs, one per significant decision. The Ledger Book (682 pages, attached as PDF + EPUB) collects every weekly essay, the senior-engineer interview Q&A, and the ADRs.
The final week's retrospective is candid about what shipped wrong (a four-eyes control that did nothing until an external audit caught it, among others) and what held up. The self-audit is the point: the history is honest, and everything else is a cache.