SharedReads

Overview

sharedreads.com is a platform for sharing books with other readers. I built and shipped all of it — schema, API, front end, auth, infrastructure and DNS — which is exactly why it was worth doing.

What it involved

• Front end in React and TypeScript.
• API in Node and Express over PostgreSQL.
• Real signup, not a demo form: email verification through a transactional provider, rate limiting on the endpoints that invite abuse, and correct trust proxy handling so the limiter sees real client IPs rather than the reverse proxy's.
• Self-hosted on my own Linux box: containerised, served by nginx, exposed through a Cloudflare Tunnel so TLS terminates at the edge and no port is open to the internet.

What running your own production stack teaches you

Two things that a managed platform hides:

Rate limiting behind a proxy is a footgun. Behind a reverse proxy every request appears to come from the proxy, so a naive limiter either throttles all users as one or trusts a spoofable header. Getting trust proxy right is the difference between a working limiter and a decorative one.

"It works locally" is a statement about your laptop. Email deliverability, TLS, tunnel health and container restarts are all production concerns that simply do not exist in development, and each one is capable of taking the whole thing down on its own.