Internal Tools Portal

Overview

mikesport.tech is the unified entry point to the team's internal tools. Static, fast, public-facing without exposing any internal data, and deployed on a hardened VPS with auto-renewing TLS.

Problem

As the internal tool count grew (delivery dashboard, enrichment, PIM, PM tool, marketing dashboard, HR system, SEO engine), people kept losing the URLs. Bookmarks and Slack pins drifted. The team needed a single canonical place that always pointed at the right tool.

Build a static portal at one domain that links out to every subdomain. Keep the portal itself absurdly simple: zero backend, zero database, zero secrets. Hard-link every internal tool with proper branding and a one-line description. The same VPS then hosts and reverse-proxies the linked tools behind coordinated Nginx vhosts and TLS.

Architecture

• Frontend: Static HTML + Tailwind CSS (CDN), hand-written, with a dark-mode toggle persisted in localStorage.
• Hosting: a single Hostinger VPS running multiple independent Nginx vhosts: the static portal plus reverse-proxy vhosts for the enrichment tool (Next.js + Express) and Horizon PM tool (Express, Asana-integrated).
• Web server: Nginx, static for the portal and reverse proxy for the app subdomains, with path-based /api routing, long timeouts for AI jobs (300s) and Asana sync (120s), and large upload caps for bulk CSV/Excel.
• Port coordination: backend services isolated on distinct ports with Nginx routing to avoid collisions; pm2 manages the background processes.
• TLS: Let's Encrypt via certbot, auto-renewing across all domains.

Tech stack

• Frontend: Static HTML, Tailwind CSS (CDN), logo asset, dark mode
• Servers: Nginx (static + reverse proxy), with Express and Next.js apps behind it
• TLS: Let's Encrypt + certbot with automated renewal

Engineering highlights

• Portal attack surface: static only, no backend, DB, or secrets on the portal itself. Each linked tool enforces its own JWT and RBAC; the portal is a secure directory.
• VPS orchestration: one instance runs several independent vhosts with port isolation, hardened headers (HSTS, CSP scoped to needed CDNs, X-Frame-Options DENY, nosniff), and robots.txt no-index.
• Single-pane navigation: every internal tool one click away (delivery dashboard, enrichment, Horizon PM tool, and more).
• Auto-TLS: certbot renewal cron, no human in the loop.

Outcome

Live at https://mikesport.tech. Not just a landing page but the orchestration point for an internal tool ecosystem, all running on one hardened VPS with coordinated TLS and reverse-proxy logic.