Project estate
Projects
The current PHP Boy Scout project estate: tools, libraries, infrastructure modules and the sites they support.
123 public entries 15 groups one pair of hands
Toolkits and Frameworks
The foundations I build other things on.
go-tool-base
The underpinnings for any Go command-line tool, and (as a few of my projects now prove) for comprehensive web services too. It standardises the boilerplate and wiring you end up writing in every Go project, and puts config, logging, self-update, a DI container and the rest straight at your fingertips. Highly opinionated, and it makes some calls people will disagree with, but it works, and it works really well. The CLI it ships with is a big part of that: keeping a Go app built, updated and maintained becomes almost trivial.
rust-tool-base
The Rust counterpart to go-tool-base, and deliberately not a straight port. Rather than copy the Go version wholesale, it reimagines the same idea through Rust idioms and off-the-shelf crates, while keeping a common signature and feature set so the two feel familiar if you switch between them. The same streamlined developer experience, done the Rust way.
Layered Configuration
The config module and the family of small adapters around it. Read and write configuration in any format, from any filesystem, and from dynamic backends like Consul, all as one layered store that can tell you where every value came from.
config-schema
JSON Schema validation over a layered store: compose partial schemas per section, and get each failure attributed back to the layer that supplied the offending value.
config backends Dynamic backend adapters
Remote systems as first-class layers, with the same precedence and provenance a file gets, and write-back wherever the system allows it safely.
config-aws-ssm
Read AWS SSM Parameter Store as a layer. Read-only: Parameter Store has no compare-and-swap write.
config-azure-appconfig
Read and write Azure App Configuration, each write guarded by the setting's ETag.
config-consul
Read and write HashiCorp Consul, with structure-preserving compare-and-swap writes.
config-etcd
A prefix of an etcd v3 cluster as a layer, with real compare-and-swap writes and a real change feed behind hot reload. Keys split on the separator into the tree, with the prefix stripped.
config-keychain
Read and write sensitive values in the OS keychain as a config layer, so a CLI's tokens never sit in a plain file on disk.
config-vault
Read secrets from HashiCorp Vault as a config layer, with the client injected so you own how it authenticates.
config filesystems Filesystem adapters
Read and write config files from filesystems other than the local disk: compiled into the binary, on a remote host over SSH, or in a cloud object store. config.OS() and config.Dir ship in the core.
config-aws-s3
Read and write a config file that lives in an AWS S3 bucket, staged and renamed over for an atomic commit.
config-azure-blob
Read and write a config file in an Azure Blob container, through the same stage-and-rename machinery a local file uses.
config-filekv
Treat a directory of single-value files as a config layer, where each filename is a key and its contents are the value. The shape Kubernetes secrets and Docker secrets already mount.
config-gcp-gcs
Read and write a config file in a Google Cloud Storage bucket, atomic per object.
config-iofs
Read config from any io/fs.FS, including an embed.FS compiled into the binary. Read-only, as io/fs is.
config-sftp
Read and write config on a remote host over SFTP, staged and renamed over so a reader never sees a half-written file.
config formats File format adapters
One small module per file format, so you only compile the parsers you use. YAML is built into the core.
config-hcl
Read and write HCL, treating it as a configuration format in its own right, not Terraform.
Framework-Independent Go Modules
Go packages that stand on their own, without needing the full go-tool-base framework around them. Many were extracted from the framework once they proved reusable.
Networking and Transport
The framework-free networking layer: servers, clients, the middleware they share, and the TLS and auth that hold them together.
transport-metrics
Cardinality-safe Prometheus instrumentation: a scrapeable /metrics endpoint (Go runtime, process and build-info collectors), optional pprof, mounted on your server or standalone. The pull/scrape counterpart to the OTel observability module; go/transport, gRPC and OTel isolated in opt-in subpackages.
Client Construction and Lifecycle
Anything sitting on an expensive SDK has the same shape of problem: every caller needs a client, building one is costly, so constructing it per call quietly multiplies that cost while constructing it once at start-up bakes in whatever failed that morning. One module solves the general case, and a small module per provider applies it to that SDK, so a project ends up holding one client rather than five. Resolving credentials is part of what makes construction expensive, and where this ties back into the toolkit's own credential handling, but it is not the point.
clientlifecycle
Resolve a value that is expensive to build exactly once, shared by every caller, race-free, and retried rather than cached if it fails. The general case the provider modules below are built on, and nothing about it is cloud-specific: any client behind a costly SDK has this shape.
Powers awsclient, azureclient, gcpclient, vaultclient
awsclient
Resolve the AWS configuration a service client is built from, once and shared or afresh per operation, as the caller chooses.
Built on clientlifecycle
azureclient
Resolve the Azure credential a service client is built from, once and shared or afresh per operation.
Built on clientlifecycle
gcpclient
Resolve the Google Cloud credential and hand it over as client options. GCP is the provider where building the service client is not free, so the seam stops one step earlier and the client stays yours to build and close.
Built on clientlifecycle
vaultclient
Resolve the Vault client an adapter talks to. Vault is the provider where the client *is* the connection prerequisite, carrying the address, namespace, token and retry policy together, so there is no separate config object to hand on.
Built on clientlifecycle
AI Building Blocks
Provider-neutral AI modules and the adapters that make them useful without tying the rest of the toolchain to one vendor.
Messaging and Collaboration
Talking to people where they already are. One contract for reading, replying and moderating, with each platform behind a swappable provider.
chat-platform
Receive, reply and moderate across chat platforms with no vendor SDK in the core. The other side of the chat modules: those talk to models, this one talks to the people.
Powers phpbotscout
chat-platform-discord
The Discord provider: read channels, reply in threads, moderate and run slash commands.
Rust Toolkit
The Rust sibling of the go-tool-base module set: small, independently-versioned crates extracted from rust-tool-base, each usable on its own.
cli
The CLI runtime family: a four-crate workspace on one version line. rtb-cli builds the application; the others each register a built-in command into the same link-time registry.
Media and Creative Tools
Tools for publishing, reels, photography and media processing.
krites
Krites is ancient Greek for 'the judge', and judging photographs is the whole job. I built it for an audience of one, my wife: a simple, UI-driven tool (not a command line in sight) that helps her rip through culling 4,000-plus wedding images to her own standards. It leans on local ML rather than a cloud-AI subscription, so it works wherever she is, signal or not. It's since grown an optional AI critic as well, expert feedback on composition, colour and technique, there to help her learn rather than to do the judging for her.
krites-models
The signed, checksum-pinned, provenance-tracked ONNX models krites downloads: fetched from upstream, converted, parity-verified, then signed as one release with a record of each model's source, version and licence.
afmpeg
FFmpeg in pure Go with no install, no CGO and no disk: a WASM build of FFmpeg running over a virtualised, in-memory filesystem, so media processing ships as a single binary and stays sandboxed. That virtual FS layer is a big part of the appeal, and the whole thing sits behind one clean Go interface, no dropping to a shell, no wrangling CGO bindings. A native FFmpeg backend is on the way too, for the performance edge cases where you can trade the security posture for speed, and it speaks the very same interface.
keryx
Keryx is ancient Greek for 'the herald', which is precisely the job. A little utility I built for myself because I'm dreadfully bad at social media: point it at the page bundle for one of these blog posts and it turns that into a sharp piece of short-form media, ready to post to the platforms I want to be on.
Signing and Trust
Proving a release came from you, that nothing has touched it since, and that someone can reach you privately when they find a problem with it.
encryption-aws-kms
The AWS KMS backend for the encryption module, deriving the shared secret and certifying inside KMS so no private key material leaves it.
signing
A small, standalone module for creating and verifying signatures on files. I pulled it out of go-tool-base so it stays lightweight and anything can use it, not just go-tool-base projects: it's what signs the CLI binaries and the ffmpeg-wasm bundle I distribute. It works through pluggable backends, so the key can live somewhere like AWS KMS rather than on disk, with Google Cloud, Azure and HashiCorp Vault to follow.
signing-aws-kms
The AWS KMS backend for the signing module, keeping private release-signing keys inside KMS while the public API stays framework-free.
signing-cli
The shareable sign and keys command builders, and nothing else. Splitting the commands off means go-tool-base and the standalone sigillum can offer the same ones without a dependency cycle between them.
Release and Distribution
Cutting the release, writing up what changed, and getting the binaries to people.
artifacts
Approved artefacts for the estate, models and runtimes, mirrored, checksummed, signed and published as one channel, so a tool that needs a large binary dependency fetches it from somewhere accountable instead of from wherever upstream happens to host it today.
Powers go/artifacts
colophon
Release orchestration that tags the commit which actually landed: work out the version your commits have earned, open the release as a merge request, then resolve the tag against the target branch itself rather than trusting whatever the forge says merged. A colophon is the mark a printer leaves at the end of the book, once it is finished.
homebrew
The Homebrew tap for phpboyscout tools, used to distribute the binaries that come out of the release pipeline.
Pipelines and Developer Tooling
The pipeline plumbing under all of it, and the tooling I reuse across every repository.
CI images Build images
Public container images that keep the toolchain repeatable across software and infrastructure projects.
ci-base
The minimal Wolfi base every other image derives from: bash, git, curl, jq and python3, and nothing else.
infra-tools
OpenTofu, tflint, trivy, checkov, gitleaks, terraform-docs and aws-cli for infrastructure pipelines.
tofu-tools
OpenTofu and tflint, with the AWS ruleset pre-baked so a pipeline is not fetching it on every run.
skillup
Version the segments of a Claude Code plugin marketplace from the history of their manifests, so each plugin gets the version its own changes earned. Correct even on a repository that has never been tagged.
Built on claude-code-plugins
Community and Support
Tools that sit between the projects and the people using them.
phpbotscout
A support and moderation bot bridging Discord and GitLab: it answers what the docs already cover, with citations, and offers to raise an issue with the thread attached when it can't. Every question it can't answer is a documentation gap with a timestamp on it.
Built on chat-platform
Infrastructure Modules
Public OpenTofu modules. The private repos that consume them stay private and are deliberately not listed here.
Sites
Static sites with their own audiences and visual identities. Public site links only; private source repositories are intentionally not linked.
Shutter & Stove
Hailey's vanlife photography and galley-kitchen cooking site, built ahead of the 2027 trip so the shape exists before the content does.
