tandoori

A production-ready, fully bilingual (DE/EN) restaurant website backed by a German-language admin CMS that lets the owner self-manage the menu, opening hours, gallery, page copy, legal text and a holiday-closure banner with no code. Built on Next.js 16 (App Router) and React 19 server components, it renders directly from a 14-table SQLite schema via Drizzle (better-sqlite3 in WAL mode with foreign-key enforcement), including a normalized many-to-many menu-item↔allergen model — composite primary key, ON DELETE CASCADE — that backs EU food-labeling disclosure, plus field-level DE→EN fallback so partially translated content never renders blank.

Twenty-two REST endpoints drive every mutation, each guarded by Zod validation, server-side iron-session auth and bcrypt-hashed credentials behind a per-IP login rate limiter, while a Sharp pipeline derives thumbnail, medium and optimized JPEGs per upload with a size cap, MIME allowlist and UUID filenames.

German legal compliance is modeled in the data itself — a structured Impressum, editable Datenschutz sections, EU ODR dispute text in both languages, and a policy-correct Restaurant JSON-LD block. It ships with a real deployment story (Next.js standalone under PM2 and Nginx, sitemap/robots, hreflang alternates, localized 404s) and was hardened through an 8-dimension automated audit — security, correctness, GDPR, i18n, SEO, deploy, content and accessibility — that triaged 77 findings.