Rebrandly

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me branded short links that replace Rebrandly: my own domain, click tracking, UTM defaults, and permissions for a team.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- Caddy in front, with on-demand TLS for customer domains
- The redirect path is one prepared statement and nothing else

THE DATA MODEL
- domains: id, hostname, workspace_id, is_verified, verified_at, certificate_state, default_redirect, is_active
- links: id, domain_id, slug, destination, title, tags_json, utm_json, expires_at, max_clicks, password_hash, is_active, created_by, created_at, archived_at
- link_versions: id, link_id, destination, changed_by, at — a destination is appended, never overwritten, because a link on a printed page must stay accountable
- clicks: id, link_id, at, referrer_host, referrer_url, country, region, device, browser, os, lang, ip_hash, bot, is_preview
- rules: id, link_id, kind, match_json, destination, position — geographic, device, language or time-based routing
- workspaces, members, roles: admin, editor, viewer
- api_keys: id, workspace_id, name, hash, scopes_json, rate_per_minute, revoked_at

THE REDIRECT, WHICH IS THE WHOLE PRODUCT
- 302, never 301. A permanent redirect cached in a browser can never be re-pointed, and re-pointing is the entire reason for a short link
- Answer in a couple of milliseconds: one indexed lookup, respond, then record the click after the response has been sent
- The link table held in memory with an invalidation on change, because this path is hit far more than anything else here
- An expired, disabled or exhausted link lands on a page that says what it was and where to go instead. Never a bare 404 — the poster is still on the wall
- A password-protected link shows a form first
- Never redirect to a `javascript:` or `data:` destination, and validate the scheme on save

THE DOMAIN, WHICH IS WHAT IS ACTUALLY BEING BOUGHT
- Add a hostname, verify ownership by a DNS record, then Caddy's on-demand TLS issues a certificate
- The ask endpoint must check the hostname against the domains table before a certificate is requested. Without that check, anybody pointing a domain at your server can make you request certificates on their behalf, and you will hit the issuer's rate limits within the hour
- The apex, a subdomain, and a path prefix on an existing site all supported
- A default redirect for the bare domain, so somebody typing just the hostname lands somewhere sensible
- Certificate expiry monitored and alerted on

UTM AND CAMPAIGN DEFAULTS
- Templates at the workspace level: source, medium, campaign, term and content, with variables filled from the link's tags
- Applied when the link is created, visible and editable, never silently rewritten afterwards
- Existing parameters on the destination preserved and merged rather than replaced
- A bulk create from a CSV that applies the template to every row, which is how a campaign of two hundred links gets made without mistakes

TRACKING CLICKS HONESTLY
- Bots flagged, never dropped, and excluded from published figures through a SQL view. Link preview fetchers in chat applications and social networks hit every link that is posted, and counting them makes a launch look like a success
- A preview fetch is identifiable from the user agent and from the timing — the same address hitting the link within a second of it being posted, once
- Unique clicks by a salted hash of address and user agent within a window, with the definition written next to the number
- Clicks by day, referrer, country, device, browser and language, computed at query time
- Export CSV

ROUTING RULES
- Send visitors from one country to a localised page, mobile visitors to an app store, and everybody else to the default
- Rules evaluated in order, first match wins, with the matched rule recorded on the click so the split is measurable
- Deep links into an app with a web fallback, which is fiddly on iOS and should be tested on a real device rather than assumed

PERMISSIONS AND SAFETY
- Roles per workspace: an editor creates links, a viewer sees the numbers, an admin manages domains
- Every destination checked against a malware list on save if one is configured, and a link reported by anybody is queued for review. An open short-link service is a phishing tool, and yours will be found within weeks of being public
- Rate limits on creation per key and per member

OPERATIONS
- .env: DATABASE_PATH, BASE_URL, HASH_SALT, SESSION_SECRET, GEOIP_DB_PATH
- Migrations on boot, each once
- Country from a local database file. Never an external geolocation API
- Nightly backup off the machine, restore script — a lost link table breaks every link anybody has ever shared
- Health endpoint that resolves one link

WHAT MATTERS MOST
The redirect speed, the 302, and the on-demand TLS check. Build those three first and load-test the redirect, then try to add a domain you do not own and confirm the certificate is refused.

Give me the repository, migrations, .env.example, the Caddy configuration with the ask endpoint, and a README with deploy steps and the DNS records for a branded domain.