Six days, 31 commits and a CMS of my own

Six days, 31 commits and a CMS of my own

On 14 October 2026 at 13:02 I made the first git commit of my project. All it said was "First commit". Today, the evening of 19 October, the history holds 31 commits and the project has grown into something I dare to call a real content management system. I named it Mella CMS.

I'm writing down how it came together over these six days. Git history makes a better diary than my own memory.

What is it, anyway?

Mella CMS is a self-contained content management system. It runs on Express and SQLite, the admin panel is built with React, and the public site is rendered on the server. It needs no separate database server, because I use Node's built-in node:sqlite. You start it and it works.

Day 1 (14 October): the foundation

The first commit was a big one: 54 files and almost 7,400 lines. It already had the server routes, the database, users, settings, views and the skeleton of the admin panel. All of that had to be in place before I could build anything interesting.

Day 2 (15 October): the editor and the page builder

This was the first busy day, with five commits. In the morning I added a rich text editor. Integrating it took three attempts, because the first version needed fixes right away. By midday I had built the visual page builder (over 3,400 lines added). By the end of the day the builder could configure the home page and show a preview in light and dark themes.

Day 3 (16 October): languages

The only commit of the day landed in the evening at 19:28, and it was a large one: 73 files changed. I added multilingual support and flag icons. A small fix followed later so the flags get alt text for accessibility.

Day 4 (17 October): brand, security and the server

The busiest day, with seven commits, and the last one came as late as 22:24. Mella got a logo and brand assets. Then I turned to the things that make a CMS trustworthy:

• Security and password recovery

• .env support and mail configuration

• hosting and startup settings

Day 5 (18 October): security audit, logs and the user guide

The day started with a security audit: I narrowed what settings can be read, put the Secure flag on cookies and added security headers. Then I checked the content of uploaded files and added size limits.

After that came the features that bring a CMS to life:

• activity, visit and click logs

• an image lightbox with captions

• the option for a user to turn off click tracking

At the end of the day I wrote the user guide in English and Estonian, with screenshots and PDFs. A single commit added over 200 files. After that I added an image slider and a PDF viewer.

Day 6 (19 October): polish

Today has been a day of finishing touches:

• updates to the contact form and the slider

• fixes to the grid layout

• documentation for the Estonian locale

• the builder preview's light/dark choice is now remembered in the browser's localStorage

• SEO: canonical URLs, responsive images and a sharing image

• hardening of 429 responses, admin caching and the CSP

In numbers

What I learned

1. Security comes continuously, not at the end. Password recovery, security headers and upload checks were done while the rest of the system was still young. Only polish was left for the end.

2. Documentation is part of the product. The bilingual user guide took a whole afternoon, but now someone else can use the CMS without my help.

3. Small commits are lovely. When something breaks, the history shows exactly when and why.

What's next? I want to move the site to real hosting and see how it behaves in actual use. I'll write about that in the next post.