MeiuxMeiux

MeiuxMeiux is the site you're already standing on — and it ships in its own portfolio because the way the site is built is a fair sample of how we build everything else. A single Go binary plus SQLite, no framework, no bundler in the request path. Fifty-plus routes responding, full admin panel, a 46-exhibit vitrine with its own capture pipeline, AI news discovery, a bid-pitch PDF renderer, a dozen skins, rate limiting, session hardening — and a scrub gate that walks every route at test time to keep upstream brand leaks out of the rendered output.

The shape of the site

• Public face — Home, Services, About, Contact, Careers, Testimonials, Terms, Privacy, News (list + detail), Portfolio (list + per-exhibit detail), plus sitemap, robots and security.txt. Each page is a server-rendered template with its own Open Graph card; no client-side router, no hydration round-trip.
• Lead form + inbound mail — honeypot + 3/hour rate limit + Postmark notification; replies arrive through the Postmark inbound webhook, and a background watcher polls for anything the webhook missed and fires a branded operator alert for new mail.
• Admin panel at /admin/ — Dashboard, Leads, Inbox, Sent, Compose, News CRUD with AI-discovery flow, Reviews CRUD, Trash, Settings, Help. Constant-time credential compare, session cookies HttpOnly + Secure + SameSite=Strict + Path=/admin, 5/15min admin login rate limit.
• Vitrine pipeline — all 46 exhibits you're browsing were captured by a Playwright + sharp tool that screenshots the live URL at desktop + mobile, pulls inline media and downloadable documents, pulls GitHub stats, security-screens the README, and writes a sidecar JSON the Go side imports into SQLite. Images ship as responsive WebP derivatives from a Google Cloud Storage CDN (derivatives larger than their source are rejected). The portfolio grid splits into an "in active development" section — anything pushed to in the last sixty days, recency-ordered, with a 52-week commit heat strip per exhibit — and the standing catalog. A nightly cron refreshes every exhibit's GitHub stats, and a stale report lists exhibits whose repo has moved since their prose was written.
• Bid-pitch PDFs — a branded proposal renderer (its own design system, Playwright-printed) turns a per-project source into an RFP-grade PDF that the portfolio can serve as a downloadable document.
• AI news discovery — admin-only SSE-streamed flow that fetches Google News RSS, dedupes against the DB, fetches OG metadata, asks an OpenRouter model for title/summary/category/tags, saves as a draft article. Brand-neutral by config.
• Session persistence — sessions live in the SQLite sessions table and survive systemd restarts; an in-memory cache hydrates at boot.

The discipline

• Scrub gate — the site was forked from a vertical-specific predecessor and scrubbed of every brand leak; a static-grep + live-route HTML scan enforces zero HARD-tier hits and runs as part of the gate ritual on every commit.
• File size budgets — Go files stay under 250 lines, CSS under 450; the renderer is split into public / admin / pagedata pieces, each one easy to hold in a head.
• No middleware chain — auth checks are flat if !h.SessionMgr.Validate(r) calls at the top of each admin handler, on purpose. The flat pattern is load-bearing for readability.
• Hardened systemd unit — NoNewPrivileges + PrivateTmp + ProtectSystem=full, unprivileged user, TLS 1.2+ only, HSTS + X-Frame-Options + Referrer-Policy headers.

Making a slow box feel fast

The origin is a two-core VPS in Europe with chronic CPU steal; most visitors are in the US, so every round trip is transatlantic and every render competes with noisy neighbours. The answer was to stop making requests rather than to buy hardware:

• One stylesheet. The public pages load a single hashed CSS bundle built from the source files; admin has its own, and the portfolio pages have a third so the rest of the site never pays for them. Skins are one file each and lazy-load only when chosen.
• A 22 KB icon subset generated from the ~108 icon names the site actually references — the build fails on an unknown one — replacing a 387 KB icon library.
• Self-hosted fonts, so no public page touches a third-party font origin.
• An origin page cache in front of the anonymous public routes: 60-second TTL, ETag and 304s, advertising s-maxage + stale-while-revalidate to the edge, and never wrapping admin, the lead form, health or the webhook.
• An accessibility pass in the same sweep — link contrast fixed in every skin, heading order corrected site-wide, ARIA on the filter chips.

How it deploys

Pull, rebuild on the server, restart the systemd unit, curl /health. The whole cycle is one shell script. No CI runner, no container registry, no orchestration. The site you're reading was deployed by the same script that deploys every other binary in the fleet, and the fleet numbers on the home page are pulled from the same Galaxy ledger that watches them all.