Velas de Oração

A virtual candle wall: each visitor with an access token lights a candle (name + intention + category + duration + privacy) and it appears on the community wall until it expires. Anyone can spin up their own wall with a private code and share it via invite link — each wall is isolated, only people with the code see that group's candles.

Rebuilt from a Lovable/TanStack Start export on Supabase, the project was re-platformed to run fully self-hosted on my VPS. AI moderation was replaced by an access-token model (the admin rotates it); everything is configurable in the /admin panel: categories with color/image/duration, campaign tokens, password, gate on/off. Every candle gets its own /c/:id link with a dynamically generated OG thumbnail (SVG→PNG via sharp) for sharing on WhatsApp/LinkedIn/etc.

Two-tier Docker stack: a web container (nginx + Vite/React/TypeScript SPA) and an api container (Fastify + better-sqlite3 + SSE, no public port). The SQLite database lives in an isolated volume mounted only into api. Security: bcrypt admin password, JWT in HttpOnly cookie, rate limits, two distinct CSS honeypots on forms, Zod validation, HMAC-hashed IPs, container hardening (no-new-privileges, read-only rootfs on api, non-root).