2026Founder, sole engineerIn production
Kingpost Software
The company site behind both products — a prerendered React front end on an Express/Mongo API, built as an npm workspaces monorepo.
The problem
A marketing site that ships as an empty SPA shell is invisible to search and to every link preview. It also needs a lead form that can't be trivially spammed, and one place where the payload shape is defined.
What I built
- Split the repo into three workspaces — shared, client, and server — with the lead payload shape and its validation defined once in the shared package and consumed by both sides as compiled output.
- Server-side rendered every public route to static HTML at build time, so each page ships with its own title, meta description, and canonical URL, plus a generated sitemap and robots.txt.
- Protected the public lead endpoint with rate limiting and a honeypot, and put the admin read behind a bearer token with an enforced 32-character minimum checked at boot.
- Made the build fail while any product's copy is still marked draft — shipping unconfirmed copy requires an explicit, documented override that production never sets.
- Validated every environment variable at startup, including the proxy-trust depth, so a misconfigured proxy can't quietly make the rate limit unenforceable.
Where it landed
- Two-stage Docker build deploying to Render as a single service, with the infrastructure declared in a version-controlled blueprint that holds no secrets.
- Every judgement call recorded as a dated decision doc, including the ones deliberately left open.