Dub

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me branded short links that replace Dub — and note that it is open source, so self-hosting it is a real answer rather than a rewrite. Build this when you want the redirect table to be yours and the shape to be small.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- Caddy in front, with on-demand TLS for custom domains

THE DATA MODEL
- domains: id, hostname, workspace_id, is_verified, certificate_state, default_redirect
- links: id, domain_id, slug, destination, title, tags_json, utm_json, expires_at, max_clicks, password_hash, is_active, created_by, created_at, archived_at
- link_versions: id, link_id, destination, changed_by, at — appended, never overwritten, because a link on a printed page must stay accountable
- clicks: id, link_id, at, referrer_host, referrer_url, country, device, browser, os, lang, ip_hash, bot, is_preview
- rules: id, link_id, kind, match_json, destination, position — geographic, device or language routing
- workspaces, members, api_keys

THE REDIRECT, WHICH IS THE WHOLE PRODUCT
- 302, never 301. A permanent redirect cached in a browser can never be re-pointed, and re-pointing is the entire reason for a short link
- Answer in a couple of milliseconds: one indexed lookup from an in-memory map, respond, then record the click after the response has been sent
- An expired, disabled or exhausted link lands on a page saying what it was and where to go instead. Never a bare 404 — the poster is still on the wall
- Validate the destination's scheme on save. Never redirect to a `javascript:` or `data:` target

THE DOMAIN, WHICH IS WHAT IS ACTUALLY BEING BOUGHT
- Add a hostname, verify by a DNS record, and let Caddy's on-demand TLS issue a certificate
- The ask endpoint must check the hostname against the domains table before a certificate is requested. Without that check anybody pointing a domain at your server makes you request certificates on their behalf, and you hit the issuer's rate limits within the hour
- A default redirect for the bare domain, so somebody typing just the hostname lands somewhere sensible

COUNTING HONESTLY
- Bots flagged, never dropped, and excluded from published figures through a SQL view. Chat and social platforms fetch every link that is posted, and counting those makes a launch look like a success
- A preview fetch is identifiable from the user agent and from the timing — the same address within a second of posting, once
- Unique clicks by a salted hash of address and user agent within a window, with the definition written next to the number
- By day, referrer, country and device, computed at query time

SAFETY
- Destinations checked against a malware list on save if one is configured, and reported links queued for review. An open short-link service is a phishing tool and yours will be found within weeks
- Rate limits on creation per key and per member

OPERATIONS
- .env: DATABASE_PATH, BASE_URL, HASH_SALT, SESSION_SECRET, GEOIP_DB_PATH
- Migrations on boot, each once; country from a local database file, never an external API
- Nightly backup off the machine — a lost link table breaks every link anybody has ever shared
- Health endpoint that resolves one link

WHAT MATTERS MOST
Redirect speed, the 302, and the on-demand TLS check. Load-test the redirect, then try to add a domain you do not own and confirm the certificate is refused.