Build GetWaitlist

YESreplaces $15/mosaves $180/yrback to the verdict

0%0 of 29 items done

Saved on this device only. Tick prerequisites first, then work the phases in order · do not start one until the checks above it pass.

A waitlist you own: one HTML snippet pasted into any landing page posts emails to your server, each signup gets a position and a personal referral link that moves them up the queue, bots are turned away, and an admin page shows growth and exports CSV. No third-party service holds your list.

estimated effort one sittingthe files for this build are in the project pack

RuntimeNode 22, node:http and node:sqliteDatabaseSQLite in WAL modeFront endA plain HTML form snippetHostingOne small VPS behind Caddy

Before step 1

Everything below is assumed from the first step. Tick each one when you actually have it, not when you plan to.

installfree
Why Everything in this build runs on it: the server, the scripts, the tests.
Get it Download the LTS installer from nodejs.org, or install with your package manager (brew install node, or nvm install 22). Restart the terminal afterwards. open ↗
Verify node --version prints v22 or higher
installfree
Why Every step below is a command you type or a file you edit.
Get it VS Code (code.visualstudio.com), Cursor or Zed. Open a folder for the project and use the editor's built-in terminal. open ↗
Verify You can open a folder and run a command in its terminal
installfree
Why History for your code, and the way most hosts deploy.
Get it Install from git-scm.com or with your package manager, then run git init in the project folder once it exists. open ↗
Verify git --version prints a version
have readyfree
Why Phase 4 is tested by pasting the snippet into a real page on a different origin, so you need one to paste into.
Get it Any page you control: your site, a Carrd, a Notion page with an embed, or a blank HTML file served locally is enough to start.
have readyfree
Why Phase 1 rejects throwaway addresses. A maintained list saves you writing one.
Get it Download the domains file from the disposable-email-domains project on GitHub into your repo as data/disposable.txt. open ↗
decidefree
Why You store a salted hash of the signer's IP for rate limiting, never the raw address.
Get it Generate once with openssl rand -hex 32 and put it in .env as IP_SALT. Changing it later resets the rate limiter, nothing else.
accountabout $5 a month
Why This needs one process running all the time with a public address.
Get it Hetzner Cloud (from about 4 EUR), DigitalOcean or Fly.io. Ubuntu 24.04, the smallest size. You need SSH access and a public IP. Only needed for the deploy phase; develop locally first. open ↗
accountroughly $10 a year, or free on an existing domain
Why The snippet posts to this address from every page it lives on.
Get it Register at Cloudflare Registrar, Porkbun or Namecheap, or use a subdomain of one you already own. You add one DNS record in the deploy phase. open ↗
installfree
Why Automatic HTTPS in front of the Node process. Without TLS the browser features this relies on (and your visitors' trust) do not work.
Get it On the VPS: follow the install steps at caddyserver.com/docs/install for Ubuntu. One Caddyfile with your domain and a reverse_proxy line is the whole config. open ↗
Verify caddy version prints a version on the server

Data model

Create these before the first phase that stores anything. Changing a table later is the expensive kind of change.

- `signups`: id, email (unique, stored lowercased and trimmed), created_at,
  referral_code (unique short slug), referred_by (nullable referral_code),
  confirmed (bool), ip_hash, user_agent
- `referral_code` is 8 characters from an unambiguous alphabet (no 0/O/1/l/I),
  generated with a CSPRNG, retried on collision.

Store `ip_hash` as a salted hash, never the raw IP · you are collecting emails
from strangers and the raw address buys you nothing you need.

Environment variables

These go in a .env file the app reads at startup. The pack's .env.example is this table as a file · copy it, never commit the filled-in version.

Variable	Needed	Example	Where the value comes from
`PORT`	required	`3000`	Any free port; Caddy proxies to it.
`DATABASE_PATH`	required	`./data/waitlist.db`	SQLite file. Back it up; it is the list.
`IP_SALT`secret	required	`hex-from-openssl-rand`	openssl rand -hex 32, once.
`SITE_URL`	required	`https://join.yourdomain.com`	Public base URL, used in referral links.
`ALLOWED_ORIGINS`	required	`https://yoursite.com,https://www.yoursite.com`	Comma-separated origins allowed to post the form. Anything else is refused.
`REFERRAL_BOOST`	optional	`5`	Positions gained per confirmed referral.
`ADMIN_USER`	required	`admin`	Any username for the basic-auth admin pages.
`ADMIN_PASS`secret	required	`change-me-to-a-long-random-string`	Generate one: openssl rand -base64 24. Never reuse a real password.

The build, in order

1
Signup and storage
Accept an email, normalise it, store it once, and treat a repeat signup as a lost tab rather than an attack.
1. signups (id, email unique, created_at, referral_code unique, referred_by, confirmed, ip_hash, user_agent). Emails stored lowercased and trimmed.
  Files server.mjsdb.mjs
  terminal
  mkdir waitlist && cd waitlist && git init && npm init -y && npm pkg set type=module mkdir data && cp .env.example .env
2. Accept form-encoded and JSON. Normalise, validate with one conservative regex and a 254-character cap, reject domains in data/disposable.txt.
3. Insert inside a transaction. On a unique conflict, return the existing row's position rather than an error, because a double submit is a user who lost the tab.
4. Eight characters from an alphabet without 0/O/1/l/I, from crypto.randomBytes, retried on collision.
done when · tick each as it passes
watch out
- Wrap the insert in a transaction. Without it a fast double click can mint two referral codes for one person.
next phase
2
Referral mechanics
Referrals move people up the queue by exactly REFERRAL_BOOST places each, computed in one query so it stays fast at ten thousand signups.
1. Set referred_by only if the code exists, is not the signer's own, and the pair is not already recorded. Unknown or self codes are ignored silently.
2. position = rank by created_at minus REFERRAL_BOOST times that signup's confirmed referrals, floored at 1. One query with a window function or a correlated count. Never a loop in application code.
3. The link is SITE_URL plus ?ref=CODE. Also expose GET /api/position?code= so a returning signer can check.
done when · tick each as it passes
next phase
3
Abuse controls
Stop the bots a public form attracts without ever refusing a real person.
1. A text input named website, hidden with CSS (not type=hidden). Filled means: return the normal success screen, store nothing.
2. A signed timestamp in a hidden field; submissions under 2 seconds old are rejected. Sign it with IP_SALT so it cannot be forged.
3. 5 per hour and 20 per day keyed by ip_hash, stored in a table so it survives a restart.
4. 4 KB body cap. Refuse any Origin not in ALLOWED_ORIGINS with 403.
done when · tick each as it passes
next phase
4
Public surface
The paste-in snippet and the confirmation screen with a working referral link.
1. One block of HTML: a form posting to SITE_URL/api/waitlist with email, the honeypot and the timestamp field. No script tag required. Styled with inherit so it takes the host page's font.
2. Access-Control-Allow-Origin for origins in ALLOWED_ORIGINS, and handle the OPTIONS preflight.
3. Position, the personal referral link with a copy button, and share links for X, WhatsApp and email with the link pre-filled.
done when · tick each as it passes
next phase
5
Admin
See growth, find people, export, delete.
1. The chart is a GROUP BY on the date of created_at; no chart library.
2. Deleting a referrer must leave their referees' rows intact: null out referred_by rather than cascading.
3. Write rows as you read them; do not build the whole file in memory.
done when · tick each as it passes
next phase
6
Deploy and document
Live on your domain, embedded on your real landing page, documented.
1. Files deploy/waitlist.serviceCaddyfile
  terminal
  sudo cp deploy/waitlist.service /etc/systemd/system/ && sudo systemctl enable --now waitlist
2. terminal
  sqlite3 data/waitlist.db ".backup '/tmp/waitlist-$(date +%F).db'"
3. README: the snippet verbatim, the exact referral maths, the ALLOWED_ORIGINS step, and one line stating no email is ever sent by this system.
  Files README.md
done when · tick each as it passes
next phase
7
Operate it like a productproduct builder
Only for the product-builder path: know when the signup endpoint is down, never lose the database, and keep the server patched.
1. Answer 200 with the build id and a quick database read. Point a free uptime monitor (or your own, from the Healthchecks entry on this site) at it so an outage is noticed before a user notices.
2. One JSON line per request: method, path, status, duration, no raw IPs. Rotate weekly with logrotate, keep eight.
3. SQLite's .backup command makes a consistent copy while the app runs. Copy it to object storage or a second machine; then, once, restore it into a fresh checkout and confirm the app reads it.
  terminal
  sqlite3 data/app.db ".backup '/tmp/app-$(date +%F).db'" rclone copy /tmp/app-$(date +%F).db remote:backups/
4. Firewall allowing only 22, 80 and 443; unattended security updates on; the app running as an unprivileged user under systemd with Restart=on-failure.
done when · tick each as it passes

what this build does not replace

Sending email: no welcome mail, no blasts, no confirmation link. Deliverability is a whole product; export the CSV into a real sender.
Their referral-widget template gallery.
Spam filtering beyond a honeypot and rate limits: this stops bots, not a determined human.
their referral-widget templates
built-in email blasts to the list
spam filtering you didn't tune yourself

after v1, if you want it

Double opt-in via a transactional email provider, behind an interface so the sender is swappable
A public counter widget showing total signups

Need the files? The project pack on the verdict page hands your agent the whole brief · more waitlists.