dangkhoabach.vn — Personal Platform
The site you are on: one ASP.NET Core API and five Next.js apps on separate subdomains — this portfolio, ToolsHub, an app download centre, a small random-picker game and an admin console that also runs my home lab.
- Client
- Personal project
- Period
- 07/2026 - present
- Built with
- Links
- dangkhoabach.vn
What I built
- Portfolio with server rendering, EN/VI, light and dark themes, structured data and a fallback snapshot when the API is down.
- Admin console: content editing, contact inbox, users, audit log with before/after diffs, email log and app releases.
- Insights: cookie-less analytics for all public sites. Visitors are counted with a daily-rotating salted hash, so no IP address is stored.
- App releases: publish a macOS build, its Sparkle feed and release notes; the download page refreshes immediately and downloads are counted.
- Home & NAS: live status of my home lab and 21 allowlisted remote commands (see the Home Lab on TrueNAS project).
Security
- Opaque, hashed, revocable sessions; Argon2id; lockout and rate limits.
- TOTP MFA with encrypted secrets and single-use recovery codes; passkeys (WebAuthn) for passwordless sign-in and Touch ID step-up.
- Sensitive commands need a fresh MFA or passkey check; every write is audited in the same database transaction.
- The admin frontend calls the API only from the server, behind a shared-secret guard and CSRF header, with a per-request nonce CSP.
- Uploads are checked by magic bytes; SVGs are sanitised and re-serialised.
Delivery
- 249 API tests (xUnit).
- Scripted deploys to Windows IIS: standalone Next.js builds under iisnode, incremental uploads, API swaps behind an offline page and post-deploy checks.
