LuckyCharmGold - Laravel E-commerce Platform for OSRS

Overview

LuckyCharmGold has sold Old School RuneScape (OSRS) gold, accounts, items and in-game services since 2019. It is one of the established names in its niche, with 1,000+ Trustpilot reviews and 1,600+ community vouches, and it serves players around the world in multiple currencies.

I work on the platform end to end: the customer-facing store, the checkout and payment layer, the admin back office, the SEO content engine and the infrastructure it all ships on.

The challenge

Selling digital goods to gamers is a hard e-commerce problem:

• Payments are fragmented. Customers expect to pay with crypto, cards, Apple Pay, Google Pay, Revolut or a bank transfer, and each method needs a different provider.

• Fraud is constant. Stolen cards and chargebacks are common in gaming marketplaces, and once gold or an account is handed over it cannot be taken back.

• Tracking has to be exact. Paid ads only pay off if purchases are attributed correctly, and browser-only tracking misses conversions.

• The store never closes. Orders arrive around the clock, so every release has to go out without downtime and be easy to undo.

On top of that, the business was moving off a legacy system, so customers, orders, products and years of content had to come across intact.

My role

Full-stack developer and DevOps engineer. I own features from database schema to Vue component, integrate payment and marketing providers, and run the CI/CD pipeline and server setup for all three environments.

Architecture at a glance

• Application: Laravel 12 on PHP 8.2, with Vue 3 pages served through Inertia.js and styled with Tailwind CSS.

• Data: MySQL as the system of record, Redis via phpredis, and Laravel queues plus the scheduler for background work.

• Media and edge: uploads and optimised images on a DigitalOcean Spaces CDN, with Cloudflare in front and scripted cache purges.

• Integrations: a service class per provider (payments, MaxMind, GA4, Google Ads, Klaviyo, Mailjet, Trustpilot), each one isolated and logged.

Storefront and product catalog

• Gold calculator that prices as the customer types and applies tiered bulk bonuses (for example 500M earns 5M free) automatically.

• Account catalog with category filters, search and full skill and quest breakdowns for every listing, with stock synced to inventory.

• Hiscores-driven services: power-leveling pricing reads a player's real levels from the official OSRS hiscores, so quotes match the account.

• Sell flows for customers selling gold or accounts back to the store, plus a tip-a-worker feature for service staff.

• Multi-currency pricing with scheduled exchange-rate updates.

Checkout and payments

The checkout sits in front of 9 gateway integrations behind one cart:

• Crypto: Coinbase Commerce, CoinGate and NOWPayments.

• Cards and wallets: Ecommpay, Collect.js and Breeze for Visa, Mastercard, Amex and Discover, with Apple Pay and Google Pay at checkout.

• Bank payments: Noda open banking, PayOp (Revolut Pay and pay by bank) and SeamlessChex eChecks.

Gateway credentials live in the admin panel with environment fallbacks, so a processor can be switched or rotated without a deploy. Webhooks are logged, and a reconciliation command rechecks PayOp payments that are still awaiting confirmation.

Fraud prevention and account security

• MaxMind risk scoring with a configurable threshold, switched on per payment method, before an order is released for delivery.

• Veriff ID verification, plus IP and customer blacklists managed from the admin panel.

• Customer security: two-factor authentication and social login with Google, Discord, Facebook and Twitch.

• Back office access controlled by roles and permissions, so staff only see the modules they need.

Loyalty, rewards and retention

• Loyalty tiers that unlock bigger discounts as customers order more.

• Reward chests customers earn with orders and open for a chance at free items.

• Affiliate and referral programs with commission tracking, plus coupons and seasonal codes.

• Lifecycle email: abandoned cart, abandoned browse and pending-payment flows through Mailjet and Klaviyo, all on queued jobs so checkout stays fast.

Marketing and analytics

• Server-side GA4 purchase events, so conversions are recorded even when a browser blocks tracking scripts.

• Google Ads customer match fed automatically from new customers and guest orders, and sell-gold conversions synced for campaign reporting.

• Trustpilot rating sync so the live review score on the site is always current.

SEO and content engine

The site runs a large library of OSRS guides that brings in organic traffic:

• Guides CMS with topic taxonomy, scheduled publishing and controlled retirement of old URLs.

• Structured data generated per page, including FAQ schema, with a command that validates every page's markup.

• Sitemaps that refresh automatically every 15 minutes.

• Media pipeline that converts images to WebP, transcodes guide GIFs and blocks oversized images in CI before they reach production.

Admin back office

A dashboard with KPI cards for new orders, revenue growth, top customers, top products, top countries, pending deliveries, average fulfilment time and refunds. Around it sit 30+ admin modules: orders and delivery tracking, products and bulk pricing, discounts, coupons, loyalty tiers, reward chests, payment processors, anti-fraud settings, revenue and VAT reports, pages, FAQs, testimonials and widgets.

DevOps and release pipeline

• Three environments, dev, staging and production, each wired to its own branch and deployed automatically by GitHub Actions.

• Build once in CI: Composer and Vite builds run in GitHub Actions, never on the servers, and Deployer ships the finished release over rsync.

• Safe migrations: production is backed up before every migration through a narrowly scoped backup command.

• Atomic releases: config, route and view caches are warmed, queues restarted and PHP-FPM reloaded before the release symlink switches over.

• Self-healing: a health check runs after every deploy, and a failed check on production rolls back to the previous release automatically. Any environment can also be rolled back on demand.

• Secrets stay out of git: hosts, paths and keys come from per-environment GitHub secrets.

Legacy migration

A set of import commands brought users, orders and order lines, products, accounts, coupons, membership codes, referrals, blog posts, FAQs, pages and settings across from the legacy database into the new schema.

Key engineering decisions

1. One service class per provider. Adding or replacing a payment gateway touches one integration, not the checkout.

2. Queues for everything slow. Emails, analytics events and spreadsheet syncs never block a customer's request.

3. Server-side tracking. Purchase events come from the server, so GA4 and Google Ads see orders the browser would miss.

4. CI as the gatekeeper. Builds, image checks and migrations are handled by the pipeline, so production only ever receives a built, checked release.