Full-stack starter
A production foundation for Next.js and Django projects
- Year
- 2026
- Type
- Independent
- Role
- Author
- Status
- Maintained
The reusable foundation I extracted from the Au Cœur du Népal and LWNF codebases: hardened authentication, API primitives, bilingual content helpers, Docker development and production stacks, CI, backups and release tooling. New projects, including this site, start from it.
Context
After two production projects on the same stack, the same problems kept being solved twice: token rotation, lockout, email flows, pagination that doesn't duplicate rows, cache headers, backups that restore. The starter collects the versions of those solutions that survived review.
Approach
Modules were copied from the two source projects and their integration points adapted, with client data, credentials, photography and domain features (donations, trekking operations) excluded. A provenance manifest records where each file came from.
A project generator copies the starter without dependencies, secrets, data or Git history, renames it, and bootstraps fresh secrets. There is no shared default administrator password.
System architecture
Frontend
Next.js 16 · App Router · BFF
Same-origin route handlers keep access and refresh tokens in HttpOnly cookies; mutations check Origin.
Calls Identity · Called by Compose · Nginx
Backend
Identity · JWT · sessions · MFA
Email verification, password flows, refresh rotation with replay detection, session revocation, lockout, TOTP.
Calls core/, PostgreSQL · Redis · Called by Next.js 16
core/ · API primitives
Response envelopes, stable pagination, publishable models, bilingual fields, sanitising, storage and revalidation.
Called by Identity
PostgreSQL · Redis · Data · cache · queue
PostgreSQL for data; Redis for cache, lockout state and the Celery broker.
Calls Celery · Beat (async) · Called by Identity, Backups
Celery · Beat · Mail · schedules
Templated email and database-backed schedules.
Called by PostgreSQL · Redis
Operations
Compose · Nginx · Dev & prod stacks
Development and production stacks, TLS routing, non-root processes, health checks and a migration job.
Calls Next.js 16 (async) · Called by CI · release
CI · release · Exact-commit images
Checks, dependency audits, PostgreSQL integration and HTTPS browser tests gate publishing; deploys use immutable image references.
Calls Compose · Nginx (async)
Backups · Local · off-host
Daily verified backups with a restore path.
Calls PostgreSQL · Redis (async)
Technical decisions
Why extract a starter rather than use a public template?
- Decision
Build the foundation from code that had already run in production and been audited, instead of a generic template.
- Why
Every module arrives with the regression tests and comments that explain the failure it prevents, which is what makes it safe to reuse.
- Trade-off
Opinionated: it assumes Next.js, Django, PostgreSQL and Docker, and it has to be kept current by hand.
Infrastructure and deployment
Development and production Compose stacks, Nginx TLS routing, non-root production processes, health checks and a migration job. Publishing to GHCR is gated on the exact commit passing checks; deployment uses immutable image references and a daily verified backup.
Technology
- TypeScript
- Next.js
- Django
- Django REST Framework
- Celery
- PostgreSQL
- Redis
- Docker
- Nginx
- GitHub Actions
- Playwright