Shello
Full-Stack E-Commerce Platform — Angular SSR + Node.js
- Role
- Full-stack engineer
- Year
- 2026
- Status
- Live
- Stack
- Angular SSR · TypeScript · Node.js · Express · MongoDB · Docker · Kubernetes · NGINX
- Auth
- Rotating cookies + OAuth + TOTP
- Deployment
- Docker + K8s-ready
Overview
Shello is a full-stack e-commerce platform built with Angular 18 SSR and a Node.js/Express/TypeScript API on MongoDB, selling protective smartphone accessories sourced via pre-order import rather than in-house manufacturing. The backend exposes versioned REST APIs (/api/v1) with refresh tokens rotated and stored as HMAC hashes in HttpOnly cookies, Google OAuth sign-in, TOTP two-factor for admins, and role-based access control. Checkout runs inside MongoDB transactions with atomic stock decrements and server-side pricing. The Angular SSR frontend ships in Georgian and English, with an admin dashboard for products, orders, users, security and CMS page toggles. The stack is containerized with Docker Compose behind Nginx and includes Kubernetes manifests (Ingress, cert-manager, health probes); the public demo runs as a static Vercel storefront.
Problem
Build a security-first e-commerce platform where the frontend and backend evolve independently, the auth flow resists token theft and replay, and the same containers run locally, on Docker Compose, or on Kubernetes.
What I built
- Modular architecture with versioned REST APIs and clear frontend/backend separation
- Rotating refresh tokens in HttpOnly cookies, Google OAuth, admin TOTP 2FA, and role-based access control
- Angular SSR frontend with RxJS, SCSS, role-aware routing, and Georgian/English builds
- Containerized with Docker Compose behind Nginx; Kubernetes manifests for the same topology
- MongoDB transactions, indexes and JSON-schema validators for order and stock integrity
Key decisions
- Stack
- Angular SSR + Node
- Auth
- Rotating cookies + OAuth + TOTP
- Deployment
- Docker + K8s-ready
Stack
Angular SSR · TypeScript · Node.js · Express · MongoDB · Docker · Kubernetes · NGINX
Outcome
Live · 2026. Live at shello-demo.vercel.app. Layering refresh tokens in HttpOnly cookies on top of MFA and RBAC forced a cleaner separation between session state and UI state — which is exactly what made bolting on the admin dashboard cheap later.
Plates
12 screens
Next case — 02 / 10
Lumina GamesAll work