Developer Portfolio CMS

A full-stack Content Management System that serves as both a public
portfolio website and a private admin dashboard for managing all
portfolio content without touching code.

## What It Does

Visitors can view projects, skills, certificates, work experience,
education, and blog articles, download a resume, and send contact
messages through the public-facing portfolio site.

As the administrator I can manage all of this through a custom-built
CMS dashboard — adding projects, writing blog posts, uploading
certificates, and reading contact messages — without ever editing HTML.

## Technical Architecture

The backend is built with Django and Django REST Framework, serving
both server-rendered HTML templates for the public frontend and a
documented REST API for external consumers.

The database is PostgreSQL with a normalized relational schema.
All models inherit from a shared abstract base that provides UUID
primary keys and automatic timestamps.

The frontend uses Tailwind CSS with custom animations and a dark theme.
The contact form submits to the REST API via JavaScript fetch, giving
a smooth user experience without a full page reload.

## Infrastructure and DevOps

The entire AWS infrastructure is provisioned with Terraform as code —
VPC, public subnet, Internet Gateway, EC2 instance, Elastic IP,
S3 bucket for media storage, and IAM roles with least-privilege policies.

The application runs in Docker containers orchestrated by Docker Compose.
A multi-stage Dockerfile produces a lean production image that runs as
a non-root user. Nginx sits in front of Gunicorn handling SSL
termination, static file serving, gzip compression, and security headers.

GitHub Actions runs the full test suite on every push. When tests pass
on main, the production image is built, pushed to Docker Hub, and
deployed to EC2 automatically. The entire pipeline takes under 5 minutes.

HTTPS is provided by Let's Encrypt with automatic renewal via a cron job.

## Security

Rate limiting on the contact API endpoint prevents spam. File upload
validators verify magic bytes to prevent disguised malicious uploads.
All security headers are set — HSTS, X-Frame-Options, CSP,
X-Content-Type-Options. Cookies are secure and HttpOnly.
The database is never exposed to the internet.

## Testing

34 automated tests cover model behavior, API endpoint validation,
serializer field rules, and integration between layers. Tests run
automatically in CI before every deployment.