Slipway - Internal Developer Platform with a CLI and Service Catalogue

Home, the service catalogue, service detail with 8 tabs, the approval queue and request detail. All 27 services and all 17 requests open their own detail page.

Production readiness, observability, security hygiene, documentation and dependency freshness, each with Bronze, Silver and Gold levels, evidence and a fix hint. Some checks block a deploy to staging or prod.

A tier 1 prod deploy needs one tier 1 release approver; prod access to subscriber-personal data needs two approvers from data platform and security, and the approval lapses after 4 hours. No requester can approve their own request.

Across 9 systems from USSD to billing and number porting, with 10 teams, 26 users, 6 golden-path templates, 27 deployments and 17 requests covering all 6 request types.

Ownership Nobody Kept Up to Date

Ownership lived in a spreadsheet eight months out of date. The catalogue reads a Backstage-compatible catalog-info.yaml from each repository, so the owner, tier, lifecycle and dependencies are kept next to the code.

Subscriber Data Under the NDPA

Names, phone numbers, identity numbers and usage records are personal data under the Nigeria Data Protection Act 2023. Every service and resource carries a data class that drives log masking, audit of prod log reads and in-country hosting, without claiming to make Oruka compliant on its own.

Secrets That Must Never Be Printed

Values stay in the vault and are injected at runtime. Slipway stores only vault paths, versions and rotation dates, and CLI and log output passes a secret scanner that replaces anything key-shaped with [redacted] before it is written.

Approvals Auditors Can Follow

Production resources, prod data access and tier 1 prod deploys need an approver who is not the requester. Oruka's own policies set who approves, how many and for how long, and each request keeps the policy version it matched.