Reauris: a calm product, built and run solo.

The problem

A static wellness site gives people nothing to come back to. The brief was a quiet place to sit for a minute, with support at any hour. Because it touches mental health, it also had to be careful: never pose as therapy, answer a crisis safely, and keep personal words private.

Architecture

One Next.js container does everything server-side. Private data stays as close to the person as possible.

Key decisions

• One boundary for the AI

  Milo's replies come from a single server-only function behind one API route. The system prompt, with the "not a therapist" framing and the crisis response, lives in one file. Changing provider means changing one function, and no key or prompt ever reaches the browser.

• Crisis path tested before any model

  The companion runs on rule-based replies today, including the crisis branch, so the safety behaviour can be tested and shown without paying for or trusting a model first.

• The Memory Jar stays on the device

  Gratitude notes are stored in the browser's localStorage by design. There is no server table for them, so they cannot leak from one.

• No conversation logging

  The chat route deliberately logs no request or response bodies, and its errors carry no content. Personal text is treated like the Jar entries.

• Passkeys and a forced reset for staff

  The admin review queue sits behind a JWT session checked on every navigation, with passkey sign-in, a forced password change and a server-side reset script.

• Ship an image, not source

  A script type-checks, cross-builds a linux/amd64 Docker image on the Mac, streams it to the VPS over SSH, restarts it and waits for the health check. The server never sees the source or a registry credential.

What I got wrong, and changed

• Article dates first carried the content plan's dates rather than the real publish dates. They now use the day each piece went live, because search engines and readers both compare them.
• Analytics were reworked twice: first cookieless, then Google Analytics loaded only after consent, with cookies kept to reauris.com. The privacy policy was rewritten to match what the code does.
• Building the product was the quick part. Traffic for a new health site depends on trust and distribution, so the next work is a named expert reviewer, Search Console and a real model behind Milo, not more features.

Stack

• Next.js 16
• React 19
• TypeScript
• Tailwind v4
• MySQL
• SimpleWebAuthn
• JWT (jose)
• Docker
• Ubuntu VPS