Sulakshana Truck & Body Techno
A production platform for a truck and lorry body builder in Sri Lanka, rebuilt from the ground up: an immersive Next.js 16 website, a secure Next.js admin panel, and a .NET 10 Clean Architecture API on PostgreSQL 17, deployed with Docker on a hardened AWS Lightsail server and rated A+ for both TLS and security headers.
1 / 70Overview
Sulakshana Truck & Body Techno has built lorry bodies in Homagama, Sri Lanka, since 2011. I first delivered the business a Flask website, then re-engineered the whole platform as a three-part system: a public website in Next.js 16 and React 19, a private admin panel built as a backend-for-frontend (so access tokens never reach the browser), and a .NET 10 API following Clean Architecture (Domain, Application, Infrastructure and Api layers) with EF Core and PostgreSQL 17.
The public site is designed to convert visitors into enquiries: an animated hero and 'What we build' showcase, a filterable gallery, a parts marketplace with quick view, smooth weighted scrolling, and contact and product forms that save every lead before WhatsApp or SMS opens. Pages are pre-rendered and refreshed within seconds of any change in the admin, and keep serving the last good version if the API is ever unreachable.
Security and operations were treated as first-class requirements. Accounts use rotating refresh tokens, atomic lockout and mandatory TOTP two-factor sign-in for privileged roles; uploads are re-encoded to WebP; a strict nonce-based Content Security Policy protects every page. A single setup script turns a fresh Ubuntu server into a hardened host, releases are health-checked with automatic rollback, and nightly encrypted backups and weekly snapshots run on their own.
Built with
Public Website
- Immersive, motion-rich design: animated hero carousel, 'What we build' showcase, process timeline, client logos and stats, with smooth Lenis scrolling and full support for reduced-motion settings.
- Gallery with category filters and a lightbox, and a parts marketplace with multi-photo posts and quick view.
- Enquiry-first contact and product forms that store every lead in the admin inbox before handing off to WhatsApp or SMS.
- Search-ready from day one: per-page metadata, canonical URLs, sitemap, Open Graph share images and AutoBodyShop structured data for Google's local results.
- Animated, on-brand 404 and 500 pages, plus permanent redirects from the previous site's URLs so existing Google rankings carry over.
- Content served under the business's own domain, including every uploaded photo, proxied privately from object storage.
Admin Panel
- Manage builds, gallery, marketplace, clients, process steps, 'why us' cards and all site settings (contact details, hours, stats, SEO, social links, notifications) without touching code.
- Media library that converts every upload into three WebP sizes, records alt text, and blocks deletion of photos still in use.
- Enquiry inbox with email notifications, team accounts with Owner, Admin and Editor roles, and a full activity log.
- A browser-only watermark tool that brands photos with the company logo and returns them in their original format, with nothing uploaded to the server.
- Changes appear on the live website within seconds through on-demand page revalidation.
API & Architecture
- .NET 10 minimal APIs organised in Clean Architecture layers, with EF Core migrations, FluentValidation and consistent problem-details errors.
- Backend-for-frontend admin: the Next.js server holds the tokens, so the browser only ever sees a secure session cookie.
- Image pipeline built on SkiaSharp that re-encodes uploads, strips hidden metadata such as GPS location and stores them in an S3-compatible bucket.
- Content import and re-import tooling that seeds a new database with all text and photos in one command.
- 131 unit tests, 29 integration tests against a real PostgreSQL database, and a 64-step end-to-end smoke test.
Security
- JWT access tokens with rotating refresh tokens; reusing an old refresh token ends the whole session.
- Atomic, race-safe account lockout, password reset protections, and mandatory TOTP two-factor sign-in for Owners and Admins.
- Strict Content Security Policy with per-request nonces, HSTS preload, and frame, MIME and permissions headers: rated A+ by SSL Labs and securityheaders.com.
- Rate limits on sign-in, uploads and outgoing email; the API and database are never exposed to the internet.
- Hardened containers (non-root, read-only file systems, all Linux capabilities dropped) with secrets mounted as files.
- Verified by black-box attack testing and fuzzing (671 requests, zero server errors) and a clean dependency audit.
DevOps & Hosting
- One-command server setup on Ubuntu 24.04: firewall, fail2ban, key-only SSH, automatic security updates, Docker, TLS certificates and schedules.
- Zero-downtime releases: each deploy builds at low priority, backs up the database before migrations, health-checks the new container and rolls back automatically on failure.
- Nightly backups encrypted with age and stored in a separate bucket (7 daily, 4 weekly and 6 monthly copies), plus a weekly Lightsail snapshot.
- Nginx reverse proxy with HTTP/2, caching for media, rate limiting, and www-to-apex redirects for a single canonical domain.
- A full hosting and operations guide covering setup, releases, rollback, recovery and troubleshooting, written for a non-technical owner.