Balaka

<p align="center"> <img src="brand/logo-full.svg" alt="Balaka" height="64"> </p> <p align="center"> <a href="https://github.com/artivisi/balaka/actions/workflows/ci.yml"><img src="https://github.com/artivisi/balaka/actions/workflows/ci.yml/badge.svg" alt="CI"></a> <a href="https://codecov.io/gh/artivisi/balaka"><img src="https://codecov.io/gh/artivisi/balaka/graph/badge.svg" alt="codecov"></a> <a href="https://sonarcloud.io/summary/new_code?id=artivisi_aplikasi-akunting"><img src="https://sonarcloud.io/api/project_badges/measure?project=artivisi_aplikasi-akunting&metric=alert_status" alt="Quality Gate Status"></a> <a href="https://sonarcloud.io/summary/new_code?id=artivisi_aplikasi-akunting"><img src="https://sonarcloud.io/api/project_badges/measure?project=artivisi_aplikasi-akunting&metric=security_rating" alt="Security Rating"></a> <a href="https://sonarcloud.io/summary/new_code?id=artivisi_aplikasi-akunting"><img src="https://sonarcloud.io/api/project_badges/measure?project=artivisi_aplikasi-akunting&metric=sqale_rating" alt="Maintainability Rating"></a> </p>

Accounting application for Indonesian small businesses. Spring Boot 4.0.3 + Thymeleaf + PostgreSQL.

Production-ready features:

• ✅ Core accounting (Chart of Accounts, journal entries, financial reports)
• ✅ Indonesian tax compliance (PPN, PPh 21/23/4(2), e-Faktur, e-Bupot)
• ✅ Payroll with BPJS and automatic PPh 21 calculation
• ✅ Fixed assets with depreciation (straight-line, declining balance)
• ✅ Inventory & simple production (FIFO/weighted average, BOM, production orders)
• ✅ Security hardening (AES-256-GCM encryption, audit logging, RBAC, CSP headers)
• ✅ DevSecOps (CodeQL, SpotBugs, OWASP ZAP DAST, Dependency-Check)

Industry support:

• IT Services & Consulting
• Online Sellers (marketplace integration ready)
• Manufacturing (coffee shops, F&B with BOM)
• Education (universities, student billing & scholarships)

Quick Start

# Prerequisites: Java 25, Docker

# Run tests
./mvnw test

# Run with visible browser (debugging)
./mvnw test -Dtest=ChartOfAccountSeedDataTest -Dplaywright.headless=false -Dplaywright.slowmo=100

# Run OWASP ZAP DAST security scan - quick mode (~5 min, passive only)
./mvnw test -Dtest=ZapDastTest -Ddast.enabled=true -Ddast.quick=true

# Run full DAST with active scanning (~20 min, SQLi/XSS/path traversal)
./mvnw test -Dtest=ZapDastTest -Ddast.enabled=true

# Run SpotBugs security analysis
./mvnw spotbugs:spotbugs

Documentation

| Document | Description | |----------|-------------| | User Manual | End-user documentation (Indonesian) | | Features & Roadmap | Current features and future plans | | Architecture | Tech stack, data model, infrastructure | | Operations Guide | Deployment, release, backup/restore | | Tax Compliance | Indonesian tax handling | | Security Testing | Penetration testing checklist | | Implementation Plan | Detailed implementation status | | ADRs | Architecture decision records | | SonarCloud | Code quality & security analysis |

Project Status

All 16 phases complete. Core accounting, tax compliance, payroll, fixed assets, inventory & production, security hardening, API foundation, bank reconciliation, analytics, invoicing, recurring transactions, tax data management, OpenAPI, fiscal adjustments, payroll API, user manual.

• 3,600+ tests, 80%+ line coverage
• 4 industry seed packs, 20-file user manual
• SpotBugs/FindSecBugs: 0 issues
• OWASP ZAP DAST: 0 HIGH, 0 MEDIUM

See Features & Roadmap for complete feature list and Implementation Plan for detailed status.

License

Apache License 2.0