The system: a custom single-page ERP — Dashboard, Workshop, Customers & Vehicles, Bookings, Accounting, Inventory, HR, CRM, Ads Manager, Reports and Settings — backed by a self-contained PHP/SQLite API, plus a public PPF booking wizard and a token-based customer invoice portal. Now in its sixth version, in daily production use since mid-June 2026.

The problem

Generic ERPs model generic businesses. A PPF and detailing shop doesn't work like a generic retailer: a single work order isn't "one line item," it's a vehicle moving panel by panel — hood, roof, both fenders, four doors, bumpers, trunk — through a sequence of physical stages that differs depending on whether the job is paint protection film, window tint, or ceramic coating. Layer onto that a real accounting department that needs VAT and multi-currency support, an HR desk that needs to know who's actually clocked in right now, a marketing function buying ads on four different platforms, and a finance team that still deals in post-dated cheques — and it becomes clear why the owner had been stitching together spreadsheets, WhatsApp and paper instead of buying software that almost, but never quite, fit.

The shape of the system

Shamil is a vanilla-JavaScript single-page application talking to one PHP API backend on SQLite — no framework, no ORM, no external services beyond the ad platforms it integrates with. The API alone spans 27 route modules: accounting, approvals, attachments, attendance, auth, bills, bookings, chat, cheques, commissions, crm, currencies, customers, employees, expenses, file handling, health checks, inventory, invoices, payments, a public portal, reports, global search, services, settings, vehicles and vendors. On the frontend, eleven page modules — Dashboard, Workshop, Customers, Bookings, Accounting, Inventory, HR, CRM, Ads, Reports and Settings — total close to 16,000 lines of interface and business logic on their own, with Accounting alone accounting for more than 6,700 of them.

The Workshop board: tracking a car panel by panel, not job by job

This is the part that doesn't exist in off-the-shelf software. Every vehicle is a Kanban card that moves through real installation stages — Vehicle Reception, Initial Inspection, Vehicle Wash, Surface Preparation, Cutting & Preparation, Installation, Paint Correction / Polishing, Coating Application, Quality Control Inspection, Vehicle Delivery — and within each job, individual zones (Hood, Roof, Front/Rear Bumper, each door, each fender, Trunk) are tracked separately, because a PPF install genuinely does progress panel by panel. A service-to-stage matrix decides which stages apply to which service type, so a tint job doesn't show coating stages and vice versa, and a "legacy" safety-net column catches any work order sitting in a stage that's since been retired, so nothing silently disappears as the workflow evolves. An animated tracker visualizes where a given car actually is in the shop right now.

Accounting built like Zoho Books, purpose-fit for this shop

The Accounting module is the single largest piece of the system — over 6,700 lines of double-entry logic, explicitly modeled on Zoho Books, Xero and Sage. It covers the full sales cycle (estimates, invoices, payments, returns, recurring invoices, statements) and the full purchase cycle (vendors, bills, payments, returns, purchase orders, credits), with multi-currency and VAT/tax handling throughout, and a reporting suite covering the Chart of Accounts, General Ledger, Journal, Profit & Loss, Balance Sheet, Aging and VAT reports. Two details a generic accounting package wouldn't include out of the box: dedicated cheque tracking for post-dated cheques, still a standard payment instrument in this market, and a commissions module tying sales staff pay directly to the deals they close.

A 4-platform ads dashboard that never sends a token to the server

The Ads Manager connects Google Ads, Meta Ads, Snapchat Ads and TikTok Ads through each platform's own OAuth flow, then aggregates spend and campaign performance across all four into one KPI dashboard — instead of the owner logging into four separate ad consoles to piece together what marketing actually costs. Every access token is kept in the browser's local storage only; none of them are ever sent to or stored on the server, which removes an entire category of credential-leak risk from a feature that's inherently about connecting to outside platforms.

The back office most ERPs leave out

HR runs a live attendance board — a real-time clock against actual check-in and check-out state, not a static timesheet filled in after the fact — alongside standard employee records. Around it sit the pieces that make software feel built for this business rather than adapted to it: an internal approvals workflow, an internal chat module so staff aren't coordinating over WhatsApp, a full CRM for communications, tasks and pipeline, and granular role-based permissions — every module exposes its own view / create / edit / delete grants, so a technician's login and the owner's login see genuinely different systems.

What the customer sees

Two surfaces are public, and both share the same panel-level thinking as the Workshop board. The PPF booking page walks a customer through vehicle details, a zone-by-zone selection of exactly which panels they want covered, and a confirmation screen with a trackable order number — no account required. The invoice portal is token-based: a customer follows a private link and sees their invoice directly, with no login to create or remember, backed by the same accounting data the office runs on.

Built to actually run a business, not just demo one

This isn't a prototype — it's infrastructure the shop depends on daily. Authentication runs on JWT with rate-limited login attempts and automatic lockout after repeated failures; sensitive fields are encrypted at rest; every significant action is written to an audit log; and the SQLite database backs itself up automatically, with the actual backup history showing daily snapshots running continuously from mid-June through the present, with older backups rotated out on a retention schedule. Choosing SQLite over a client-server database was deliberate: there's no separate database server to provision, secure or keep alive — the entire operational footprint is one PHP application and one file-based database, which keeps hosting simple and failure modes few.

Stack & scope

Vanilla JavaScript SPA on a shared core/app/tools/icons foundation, eleven feature modules (~16,000 lines) covering Dashboard, Workshop, Customers, Bookings, Accounting, Inventory, HR, CRM, Ads and Reports, plus Settings with company configuration, user management and role-based permissions. A single PHP 8 API (~170KB, 27 route modules) on SQLite, with JWT authentication, rate-limiting and lockout protection, field-level encryption, full audit logging, automated backup rotation, and file handling for attachments, cheque images and work-order photos. OAuth integrations with four advertising platforms, plus two public-facing customer surfaces. Database schema, every module's business logic, security architecture, and deployment — designed and built end to end by one developer, now on version 6 after continuous iteration against a real, running business.

Running a specialized business that off-the-shelf software doesn't quite fit? Let's talk.