Project / 2026
Portfolio Platform
A production content platform for an image-led portfolio, combining an authenticated editorial workspace, versioned APIs, asynchronous image processing, infrastructure as code, and protected CI/CD.
The idea
A photography portfolio may look static to its visitors, but maintaining one involves a much larger system. This project turns that hidden work into a cohesive publishing platform: an authenticated workspace for editorial decisions, a reliable media pipeline for high-resolution originals, and production infrastructure that can be deployed, observed, recovered, and evolved without coupling the public site to backend internals.
The system in use
Selected views from the working product, shown at the scale of the decisions they support.
Publishing state, recent content activity, and archive readiness are visible from one restrained control surface.
Project settings, direct uploads, image processing state, cover selection, and gallery order remain connected in a single workflow.
Design direction
The platform is divided by responsibility. A React Admin handles projects, metadata, covers, featured selections, ordering, uploads, and explicit publishing. A NestJS API owns authentication, content rules, presigned uploads, public contracts, and queue submission, while a separate TypeScript Worker processes high-resolution images with Sharp outside the request path.
Structured content lives in PostgreSQL through Prisma, while original files and responsive variants remain in Cloudflare R2. Amazon SQS separates upload completion from image processing, and the public Astro site consumes a versioned read-only API at build time. This keeps the visitor experience static and fast without giving up dynamic editorial control.
Production runs on a multi-account AWS foundation defined with Terraform. ECS on EC2, ECR, IAM, SSM, CloudWatch, backups, alarms, and dead-letter handling form the operational boundary. GitHub Actions uses short-lived OIDC credentials to validate, deploy immutable image digests, run database migrations, verify health, and perform protected application rollbacks.
- Editorial control plane Auth0-protected Admin workflows manage projects, images, metadata, covers, homepage features, ordering, and explicit public-site rebuilds.
- Asynchronous media pipeline Direct presigned uploads flow from R2 through SQS to an idempotent Sharp Worker that produces responsive variants and tracks processing state.
- Infrastructure as code Terraform describes isolated AWS environments, networking, compute, queues, registries, identity boundaries, secrets integration, monitoring, and backups.
- Protected delivery GitHub Actions builds and scans the monorepo, assumes AWS roles through OIDC, deploys digest-pinned containers, runs migrations, checks health, and supports controlled rollback.
- Static by design The Astro website reads versioned public data during Cloudflare builds, keeping the public experience fast while editorial changes remain deliberate and auditable.