Ecosystem

The platform behind this portfolio: nine independent projects, each with its own repository, pipeline and deployment, around a single private API that is the source of truth. Part of it is public (the portfolio, the link hub, the terminal and the pixel-art house) and part of it is for me alone.

Goal. To run my presence on the web and the tools I use every day (content, statistics, short links, finance and a newsletter) from one place, without depending on third-party services and with security, SEO and accessibility cared for equally in every piece.

What it does. The private part:

• API: the core, in Fastify with PostgreSQL and Drizzle. 30 business contexts, about 270 routes and 63 migrations. It is not exposed to the internet: only the servers of the other sites call it.
• CDN: stores and serves the files, resizes images with sharp and keeps their metadata in SQLite. Protected files can only be embedded from the allowed origins.
• Backoffice: the panel where I manage the content, the statistics, the short links and my private notes.
• Finance: clients, projects, contacts, time tracking and invoices with their PDF. It has no login of its own: the backoffice hands its session over.
• Newsletter: one article a day that the API writes with Claude from cited sources, within a daily and a monthly budget. What the model answers is treated as untrusted text and validated before it is stored.
• Alerts: when a site goes down or a contact message arrives, the API messages me on Telegram.

SEO. The public sites follow one playbook: canonicals, hreflang in Spanish, English and Japanese, sitemaps and structured data. The private sites are never indexed.

Accessibility. WCAG 2.2 AA as a minimum on every site, with the contrast of every theme checked by tests.

Performance. Budgets of LCP under 1.8 s, INP under 150 ms, CLS under 0.05 and 25 kB of own JavaScript per page. The portfolio's home page measures a 1.75 s LCP on a phone with a CPU four times slower over slow 4G.

Security and privacy. The browser never talks to the API: every site is a BFF that calls it from its server with a key of its own, which only holds the permissions it needs. Argon2 passwords, passkeys and a second factor whose secrets are encrypted with AES-256-GCM; session tokens rotate and reusing one revokes its whole family, and cookies are __Host-, HttpOnly and SameSite=Strict. Sensitive writes ask for a fresh TOTP code, there are global and per-consumer rate limits, outgoing requests cannot reach private addresses, and the public sites use a strict nonce-based CSP and HSTS with preload. Analytics are first-party, without third-party scripts: each visitor is counted with a daily-salted HMAC, and DNT and Sec-GPC are honoured.

Architecture and quality. Strict TypeScript and a hexagonal architecture in every project, with a domain free of external dependencies and a lint rule that enforces it. When the content changes, the API tells each site to rebuild only what changed. Everything runs in Docker containers behind Caddy (HTTP/3), and every repository passes format, lint, types, tests and build on GitHub Actions before it deploys.

Status. In production and growing all the time: over 60 steps built since 2026.