SCALECON Jakarta 2027: Site, Tickets & Attendee App

Context

SCALECON Surabaya 2026 ran on a set of separate tools: GOERS for tickets, a Google Sheet as the attendee list, a standalone twibbon app, and WhatsApp automation. For the Jakarta 2027 edition the team wanted ticketing in-house and one account per attendee across everything the event offers.

As with Surabaya, I built this with one teammate. The split below is what I did.

What I built

scalecon.ai, the conference site

I set up the Next.js 16 site from scratch with Docker, Caddy, and GitLab CI deployment.

• Partner pages. I built the four partner pages (sponsor, speaker, media, community), each with a working application form. Applications go to the review inbox by email and to WhatsApp as a lead alert, with the applicant’s PDF attached.
• Tickets. Pass cards and group-buy tiers link straight into checkout.
• Support and media. A Chatwoot support widget, and the media library from past editions.
• Hosting. Fixed a redirect loop between Cloudflare’s Flexible SSL and the origin by serving the apex over plain HTTP at the origin.

Ticketing: a fork of Hi.Events

The open-source Hi.Events platform (Laravel + React) runs in-house at app.scalecon.ai.

• Duitku payments. I added Duitku as a payment provider. Unpaid returns cancel the order and no longer lock the attendee’s email. Duitku is asked for the real payment status before a return is resolved.
• Sign-in and deployment. Google SSO, deployment on Dewacloud behind Caddy, and the routing that splits app.scalecon.ai between the ticketing engine and the attendee app.
• Ticket upgrades. Paid upgrades apply to the exact ticket they were bought for and re-issue it under the new tier.
• Checkout hardening. Promo codes that say when they don’t apply, per-route rate limits keyed on the real visitor IP behind Cloudflare, and an end-to-end checkout test job in CI.
• Balance claims. Admins review pass-holder balance claims and credit them to Dewacloud and DewaVPS.

app.scalecon.ai, the attendee app

• Ticket-gated sign-in. Login by magic link or Google, allowed only for attendees with a valid ticket. The pass tier is read from the ticketing system’s orders, not from a spreadsheet.
• One session across subdomains. A shared session cookie lets attendees move between the app and recording.scalecon.ai without signing in again. On the recordings site, premium content requires an entitlement and each viewer only sees recordings up to their own edition.
• Referrals. Per-event referral links, commission earned on sold tickets, and payout bank details locked behind an explicit Edit.
• Upgrades and claims. An upgrade offer on each ticket below VIP, linked to that ticket, plus a Claim tab for Builder and VIP holders.
• AI twibbon. I ported the Surabaya generator onto Gemini and Sharp. Gemini only ever receives the photo, never the template. The photo is fitted into the frame cutout before generation. Name tags are drawn deterministically instead of asking the model to render text. Each attendee has a generation cap, and organisers can see everything generated.
• Operations. Nightly backups of both stacks on the shared node.

Stack

Next.js 16 · React 19 · NextAuth v5 · Prisma 7 · PostgreSQL · Laravel (Hi.Events) · Duitku · Gemini · Sharp · Caddy · Cloudflare · Docker · GitLab CI