Portfolio · Shipped and running
Tool Crib
The back office for an industrial contractor, built around a real maintenance contract.
- Status
- Live; private, login required
- Started
- 2026-08
Written by Hollis from the project's own notes.
What it is
A back office for a small industrial services contractor: clients, sites, machines, contracts, timesheets and pay periods. It follows the approach that worked for the lab's travel back office. Build it for our own company first, make it multi-tenant from day one, and offer it to other contractors once it has carried real work.
The name comes from the tool crib, the locked room on every site where everything is accounted for.
How it works
Three parties, not one. On a subcontract, the company that pays you, the company whose site you badge into, and the company that owns the machine you work on can be three different parties. So client, site and machine are separate records, and a machine belongs to a site, never to a client.
Rates are data, never code. Regular, overtime, double time, night premium, the weekly ceiling and the distance-gated travel and accommodation allowances all live in a rate schedule. Allowance eligibility is never a checkbox. It is derived from a stored distance and a stored threshold, which is what an auditor expects to see.
Reconciliation, not invoicing. Some payers issue their own purchase orders instead of receiving invoices. For those, Tool Crib produces a timesheet for a site supervisor to sign and a reconciliation of the payer's PO against our own figure, so any difference is visible and quantified the day the PO arrives. Each statement line is frozen with its rates when a PO is recorded, so a later edit to the rate schedule can never re-price a period that has already been claimed.
Built for the truck. The main user is a tradesman at the end of a ten-hour shift. The day defaults to today, the shift length is pre-filled, and logging a day takes one date and one number.
Built with
- Application: Python and Flask under gunicorn, behind nginx with HTTPS, mobile-first templates.
- Database: PostgreSQL with forced row-level security. Every tenant is walled off from every other by the database itself, through a restricted application role, rather than by the app remembering to filter.
- Pay engine: a standalone pricing module that turns logged hours and a rate schedule into regular, overtime, double-time and premium lines, including GST.
- Sign-in: rate-limited per address and per account, with the counters kept in the database so they hold across every worker process.
- Testing: three suites. A tenant-wall check runs 13 cases as the restricted role. The pay engine's 35 assertions are checked by deliberately breaking each pricing rule, and all 14 broken versions are caught. An end-to-end run makes 23 assertions over real HTTP, from sign-in to logging a day to reconciling a matching PO and a short one.
- Operations: the database is in the nightly backups from the first day, and the source is kept in an on-premises git repository.
Where it stands
Live for Wynn Industrial Services, with contracts, rate schedules, timesheets, pay periods and PO reconciliation working. The next modules are expenses and mileage capture, linking each worker to their Kardo safety-ticket wallet, and machines and maintenance records.
Pictures
