Project estate
Projects
The current PHP Boy Scout project estate: tools, libraries, infrastructure modules and the sites they support.
101 public entries 14 groups one pair of hands
Toolkits and Frameworks
The foundations I build other things on.
go-tool-base
The underpinnings for any Go command-line tool, and (as a few of my projects now prove) for comprehensive web services too. It standardises the boilerplate and wiring you end up writing in every Go project, and puts config, logging, self-update, a DI container and the rest straight at your fingertips. Highly opinionated, and it makes some calls people will disagree with, but it works, and it works really well. The CLI it ships with is a big part of that: keeping a Go app built, updated and maintained becomes almost trivial.
rust-tool-base
The Rust counterpart to go-tool-base, and deliberately not a straight port. Rather than copy the Go version wholesale, it reimagines the same idea through Rust idioms and off-the-shelf crates, while keeping a common signature and feature set so the two feel familiar if you switch between them. The same streamlined developer experience, done the Rust way.
Layered Configuration
The config module and the family of small adapters around it. Read and write configuration in any format, from any filesystem, and from dynamic backends like Consul, all as one layered store that can tell you where every value came from.
config backends Dynamic backend adapters
Remote systems as first-class layers, with the same precedence and provenance a file gets, and write-back wherever the system allows it safely.
config-aws-ssm
Read AWS SSM Parameter Store as a layer. Read-only: Parameter Store has no compare-and-swap write.
config-azure-appconfig
Read and write Azure App Configuration, each write guarded by the setting's ETag.
config-consul
Read and write HashiCorp Consul, with structure-preserving compare-and-swap writes.
config-keychain
Read and write sensitive values in the OS keychain as a config layer, so a CLI's tokens never sit in a plain file on disk.
config-vault
Read secrets from HashiCorp Vault as a config layer, with the client injected so you own how it authenticates.
config filesystems Filesystem adapters
Read and write config files from filesystems other than the local disk: compiled into the binary, on a remote host over SSH, or in a cloud object store. config.OS() and config.Dir ship in the core.
config-aws-s3
Read and write a config file that lives in an AWS S3 bucket, staged and renamed over for an atomic commit.
config-azure-blob
Read and write a config file in an Azure Blob container, through the same stage-and-rename machinery a local file uses.
config-filekv
Treat a directory of single-value files as a config layer, where each filename is a key and its contents are the value. The shape Kubernetes secrets and Docker secrets already mount.
config-gcp-gcs
Read and write a config file in a Google Cloud Storage bucket, atomic per object.
config-iofs
Read config from any io/fs.FS, including an embed.FS compiled into the binary. Read-only, as io/fs is.
config-sftp
Read and write config on a remote host over SFTP, staged and renamed over so a reader never sees a half-written file.
config formats File format adapters
One small module per file format, so you only compile the parsers you use. YAML is built into the core.
config-hcl
Read and write HCL, treating it as a configuration format in its own right, not Terraform.
Framework-Independent Go Modules
Go packages that stand on their own, without needing the full go-tool-base framework around them. Many were extracted from the framework once they proved reusable.
Networking and Transport
The framework-free networking layer: servers, clients, the middleware they share, and the TLS and auth that hold them together.
transport-metrics
Cardinality-safe Prometheus instrumentation: a scrapeable /metrics endpoint (Go runtime, process and build-info collectors), optional pprof, mounted on your server or standalone. The pull/scrape counterpart to the OTel observability module; go/transport, gRPC and OTel isolated in opt-in subpackages.
AI Building Blocks
Provider-neutral AI modules and the adapters that make them useful without tying the rest of the toolchain to one vendor.
Messaging and Collaboration
Talking to people where they already are. One contract for reading, replying and moderating, with each platform behind a swappable provider.
chat-platform
Receive, reply and moderate across chat platforms with no vendor SDK in the core. The other side of the chat modules: those talk to models, this one talks to the people.
Powers phpbotscout
chat-platform-discord
The Discord provider: read channels, reply in threads, moderate and run slash commands.
Rust Toolkit
The Rust sibling of the go-tool-base module set: small, independently-versioned crates extracted from rust-tool-base, each usable on its own.
cli
The CLI runtime family: a four-crate workspace on one version line. rtb-cli builds the application; the others each register a built-in command into the same link-time registry.
Media and Creative Tools
Tools for publishing, reels, photography and media processing.
krites
Krites is ancient Greek for 'the judge', and judging photographs is the whole job. I built it for an audience of one, my wife: a simple, UI-driven tool (not a command line in sight) that helps her rip through culling 4,000-plus wedding images to her own standards. It leans on local ML rather than a cloud-AI subscription, so it works wherever she is, signal or not. It's since grown an optional AI critic as well, expert feedback on composition, colour and technique, there to help her learn rather than to do the judging for her.
krites-models
The signed, checksum-pinned, provenance-tracked ONNX models krites downloads: fetched from upstream, converted, parity-verified, then signed as one release with a record of each model's source, version and licence.
afmpeg
FFmpeg in pure Go with no install, no CGO and no disk: a WASM build of FFmpeg running over a virtualised, in-memory filesystem, so media processing ships as a single binary and stays sandboxed. That virtual FS layer is a big part of the appeal, and the whole thing sits behind one clean Go interface, no dropping to a shell, no wrangling CGO bindings. A native FFmpeg backend is on the way too, for the performance edge cases where you can trade the security posture for speed, and it speaks the very same interface.
keryx
Keryx is ancient Greek for 'the herald', which is precisely the job. A little utility I built for myself because I'm dreadfully bad at social media: point it at the page bundle for one of these blog posts and it turns that into a sharp piece of short-form media, ready to post to the platforms I want to be on.
Signing and Trust
Proving a release came from you, that nothing has touched it since, and that someone can reach you privately when they find a problem with it.
encryption-aws-kms
The AWS KMS backend for the encryption module, deriving the shared secret and certifying inside KMS so no private key material leaves it.
signing
A small, standalone module for creating and verifying signatures on files. I pulled it out of go-tool-base so it stays lightweight and anything can use it, not just go-tool-base projects: it's what signs the CLI binaries and the ffmpeg-wasm bundle I distribute. It works through pluggable backends, so the key can live somewhere like AWS KMS rather than on disk, with Google Cloud, Azure and HashiCorp Vault to follow.
signing-aws-kms
The AWS KMS backend for the signing module, keeping private release-signing keys inside KMS while the public API stays framework-free.
signing-cli
The shareable sign and keys command builders, and nothing else. Splitting the commands off means go-tool-base and the standalone sigillum can offer the same ones without a dependency cycle between them.
Release and Distribution
Cutting the release, writing up what changed, and getting the binaries to people.
homebrew
The Homebrew tap for phpboyscout tools, used to distribute the binaries that come out of the release pipeline.
Pipelines and Developer Tooling
The pipeline plumbing under all of it, and the tooling I reuse across every repository.
CI images Build images
Public container images that keep the toolchain repeatable across software and infrastructure projects.
Community and Support
Tools that sit between the projects and the people using them.
phpbotscout
A support and moderation bot bridging Discord and GitLab: it answers what the docs already cover, with citations, and offers to raise an issue with the thread attached when it can't. Every question it can't answer is a documentation gap with a timestamp on it.
Built on chat-platform
Infrastructure Modules
Public OpenTofu modules. The private repos that consume them stay private and are deliberately not listed here.
Sites
Static sites with their own audiences and visual identities. Public site links only; private source repositories are intentionally not linked.
PHP Boy Scout blog
This site: the home for the project write-ups, leadership pieces, tutorials and the occasional personal essay.
Shutter & Stove
Hailey's vanlife photography and galley-kitchen cooking site, built ahead of the 2027 trip so the shape exists before the content does.
