Full-stack photography portfolio platform built with Next.js and Express.js, deployed as a single Docker container on Railway. The public site features dynamic photo galleries with masonry layouts, lightbox viewing, progressive image loading with blur placeholders, and support for four languages with URL-based routing. A server-rendered admin panel provides full content management — album creation, photo uploading with automatic three-tier WebP optimization, reordering, analytics, and contact form tracking. The backend enforces a layered security model with JWT authentication, CSRF protection, rate limiting, account lockout, and a malicious path detection system covering 83+ attack patterns. The platform achieves a 99+ Lighthouse score through aggressive image optimization, lazy loading, and Incremental Static Regeneration, with structured data schemas and hreflang tags for international SEO. GDPR compliance is handled through a granular cookie consent system that gates analytics behind explicit user approval.
Duration
Tech Stack
Challenge
The project required a photography portfolio that delivers high-resolution images fast without sacrificing quality, supports four languages with proper SEO for each, and gives the photographer a simple way to manage content without third-party CMS dependencies. The admin panel and API needed protection against brute force attacks, CSRF exploits, and automated scanners. The entire stack had to be packaged into a single deployable unit on cloud infrastructure while remaining GDPR-compliant.
Solution
Every uploaded photo is automatically processed into three WebP variants, and the frontend uses responsive images with blur placeholders and lazy loading to achieve a 99+ Lighthouse score. A built-in admin panel provides full album and photo management behind JWT-authenticated routes. Internationalization across four languages is paired with hreflang tags, structured data, and a dynamic sitemap for proper search indexing. The backend combines CSRF protection, rate limiting, account lockout, and a 83+ pattern malicious path detection system. Everything is packaged in a single Docker container on Railway with persistent storage and health monitoring, and a cookie consent system ensures GDPR compliance.
Here's how it looks
