WAYGFT — What Are You Grateful For Today?

Kaiti wanted to launch a worldwide wall of gratitude: anyone could anonymously share a quote, a story, a photo, or a video of something that made them smile. One human — her — would moderate every post with love before it appeared on the wall. The brand had to feel soft and personal, not like a SaaS product.

The constraints were real: every submission had to stay anonymous, but submitters needed rate-limiting so bad actors couldn’t flood the queue. Photos and videos had to load fast globally without bloating the server. The admin side had to be simple enough that one person could run the whole moderation queue on a phone. And it had to go from idea to production in a weekend.

Next.js 16 App Router with the new “proxy.ts”

Built on the App Router to get streaming, ISR, and server-side rendering for the wall. Used Next 16’s new `proxy.ts` (the successor to `middleware.ts`) to guard every /admin/* route with a JWT cookie check. The gratitude wall home page is statically rendered with ISR (60s revalidation); approving a post calls `revalidatePath('/')` for instant publish.

A schema that’s smaller than it sounds

Prisma + Postgres. Two tables: `Post` (with enum fields for `PostType` → QUOTE/STORY/PHOTO/VIDEO and `PostStatus` → PENDING/APPROVED/REJECTED), and `Admin` (email + bcrypt hash + last-login timestamp). Two compound indexes on `(status, createdAt)` and `(status, approvedAt)` keep the moderation queue and the public wall snappy as the table grows.

Privacy-first rate limiting

Six submissions per hour per IP — but the raw IP is never stored. Every submission hashes the IP with a salted SHA-256 before it touches the database. The rate limiter itself is an in-memory keyed store, so it resets on redeploy and never persists PII. Zod schemas validate every submission at the edge.

Spaces + CDN for zero-drama media

Photos and videos upload directly to DigitalOcean Spaces via a signed S3 client (`@aws-sdk/client-s3`). Every object is served from the Spaces CDN edge, not the droplet — a 4 GB droplet can run this at scale without ever touching the media path. When an admin deletes a photo post, the object is deleted from Spaces too.

A soft-landing brand

Three custom Google fonts layered together: Plus Jakarta Sans for body, Fraunces for serif headlines, Caveat for the script flourish. Pink/parchment palette with floating hearts animated by Framer Motion. A three-column autoscrolling wall that slows on hover. Duck emoji accents. A rotating-prompt hero that cycles through “music / pretty / that thing” before the user finishes reading.

An admin panel a non-engineer can actually run

Three tabs: Pending, Approved, Rejected. Each post renders inline (text, photo, or video), with approve/reject buttons and a delete confirmation. Settings page with a change-password flow. No build step, no CMS to learn — just a login and three tabs.

Shipped in a single day. Seven commits from `create-next-app` to a moderated, multimedia, CDN-backed, mobile-ready production site live at waygft.life.

• Public gratitude wall with 3-column autoscroll and opacity mask.
• Four submission types: quote, story, photo, video — all moderated.
• /latest paginated archive and per-post permalinks (/p/[id]) with social share.
• Admin portal with pending/approved/rejected queues + change-password flow.
• Rate limit: 6 submissions per hour per IP, stored as salted SHA-256 hashes.
• Mobile-first nav and wall; reduced-motion respected.
• Deployed to a $28/mo DO droplet + $5/mo Spaces bucket — ~$33/mo all-in.

The brand landed in a way that matters: warm, soft, unmistakably not a product demo. The kind of site people actually want to submit to.