Portfolio Website

This is the site you're on right now, rebuilt from the ground up. The public side is where I introduce myself, show my work and write about how I build things. Behind it is a private control center where I run all of it, so nothing on the site is hard-coded: every word, image, link and icon lives in the database and can be changed without a redeploy.

The public site

Blog posts and project pages written in Markdown and stored in PostgreSQL, with a table of contents, linkable headings and related posts matched by tags
Generated Open Graph images, so every post has a proper preview when shared
A music page with what I'm listening to right now, listening stats, a 14-day chart and my top albums, artists and tracks from Last.fm, plus a live listening badge on the home page
A contact form that confirms the sender's email with a 6-digit code before a message is delivered
Private analytics with no cookies and no stored IP addresses, which honor Global Privacy Control and Do Not Track
Light and dark themes, subtle motion that respects reduced-motion settings, and a layout that works from phone to desktop

The control center

A Markdown editor with a live preview, image uploads, scheduled publishing and SEO fields, where saving updates the public site straight away
Site-wide editing for my profile, menu, authors, media and every piece of text on the public pages, with a searchable library of nearly 10,000 icons
Website and API analytics, with requests broken down by endpoint, key, status code and country
Two-factor sign-in with an authenticator app and backup codes

The API and security

A REST API with scoped keys, rate limits, daily quotas and IP and origin restrictions, where keys are shown once and stored only as a keyed hash
Twelve configurable detection rules for credential abuse, request spikes, invalid keys and scanning, with deduplicated incidents and email alerts
Honest labels: an unusual country is an anomaly, and only I can mark something a confirmed threat

How it's built

It runs on Next.js 16 and React 19, with Bun for tooling, Drizzle on PostgreSQL, Better Auth for sign-in and Zod validating every input. PostgreSQL also handles the rate limits, the job queue and image storage, so there's no Redis or object storage to run. Public pages are prerendered and revalidated, and monitoring happens after the response so it adds no latency to API calls.

Role & Responsibilities