Claude Code skills for standing up small, private web apps fast — the kind you build to explore one idea, put online behind a login, and tear down when it stops being interesting.
Every skill here was developed by building the real thing in a live repo first, then codifying what actually worked — so what's packaged is validated sequencing, gates, and gotcha ledgers, not templates.
One framework, one host, one auth approach. The alternative — a shell here, a vendor there, a different auth per app — is how four apps end up with four architectures and none of them portable.
| Layer | Choice | Why |
|---|---|---|
| Framework | Next.js App Router | server-side compute and secrets on every app |
| Auth | self-hosted: scrypt + signed cookie | ~200 lines, no vendor, no database |
| Host | Railway | app, Postgres, and bucket are one service and one bill |
| Storage | S3 API (Railway Buckets, or R2) | commodity, swappable by endpoint |
| Database | a Postgres connection string | only when an app actually needs one |
The rule underneath: depend on the commodity, never the differentiator. RLS, hosted auth, proprietary storage SDKs, and platform-level access gates all feel like features and all make an app unportable.
/plugin marketplace add joshcoolman/bootstrap
/plugin install bootstrap@bootstrap
Then, from a brand-new empty folder:
mkdir my-app && cd my-app && claude
> /bootstrap:next-app # the whole app: styled, login, empty dashboard
> /bootstrap:deploy-next-railway # take it live
Skills also auto-trigger from plain requests ("scaffold a new app here", "put
this online"). For local development of this repo itself, load it directly:
claude --plugin-dir ~/repos/bootstrap (then /reload-plugins after edits).
| Skill | What it does |
|---|---|
| next-app | Scaffold a complete Next.js App Router app — Paper & Ink design system, a self-hosted login, deny-by-default route protection, an empty dashboard, /docs viewer, feature seams, CI. One pass, ready to build on. |
| deploy-next-railway | Deploy an existing Next.js app to Railway — provision Postgres and a Storage Bucket if needed, wire env vars, set the Pre-Deploy Command for migrations, verify live via the deploy log and browser. |
next-app creates a repo from nothing and produces a complete app rather
than a shell you then layer onto — the login and the guard are part of the
scaffold, not a second step. deploy-next-railway targets Railway project
config rather than repo files.
Allowlist auth. A short, known set of people can sign in. Access is granted
out-of-band by adding an entry to AUTH_USERS; there is no signup route, so a
stranger who finds the URL cannot self-serve access.
That covers "just me" and "me plus whoever I show it to," which is what these
apps are for. It costs about 200 lines of standard library — node:crypto
scrypt for passwords, Web Crypto HMAC for the session cookie — and no vendor,
no database, and no monthly bill.
Not included, deliberately: signup, password reset, email verification, OAuth,
roles, per-user data isolation. Sessions are stateless, so there is no
server-side revocation — signing out clears the cookie on that browser, and
rotating AUTH_SESSION_SECRET is the global sign-out. If an app grows a real
user base, that's the signal to adopt better-auth, not to extend this.
Instruction-level docs — what to build and why, not line-by-line code — for reading, or for applying a single slice to an existing repo:
| Part | What it covers |
|---|---|
| setup-wizard | pnpm setup — one command from fresh clone to a live, protected URL. Reads .env.example and fills each variable by class, so it works unchanged as an app grows keys |
| image-store | Object storage for uploads and generated images: a four-method contract, Railway Buckets by default, R2 as the swap, and the /img route that keeps presigned URLs cacheable |
| schema-reference | Generated, always-current DB map in /docs, with a CI staleness gate |
| agent-surface | Giving a personal tool an agent surface: one core, two surfaces; blast-radius framing for personal MCP servers |
| Recipe | What it produces |
|---|---|
| next-railway-app | Next.js on Railway: Postgres, bucket storage, allowlist auth, proven via a CRUD demo |
| next-selfhost-app | Self-hostable Next.js app: SQLite, local disk storage, BYOK, Docker/volume deploy — zero required vendor accounts |
New skills are developed, not written: build the feature for real in a throwaway "mule" repo, log every friction point, validate end-to-end, then codify. The full authoring contract lives in CLAUDE.md.
MIT. Free — install it, fork it, build your own bootstrap on top of it. This repo tracks what works for my own projects, so I'm not seeking contributions and there's no support: if something doesn't work the way you want, fork it and fix it.
Last shipped:
next-appconformed toproject-standard(#18) —knowledge/and the/docsviewer deleted,docs/now OVERVIEW + SPEC + DELTAS +reference/,app/hoisted to the repo root. Not yet consumer-run.- The scaffold reads the standard at Step 0, so conformance lands in the emitted files rather than in a doc restating them.
docs/CODE-STANDARDS.mdis gone and prohibited. - Issue triage: #1, #2, #7, #8, #9 closed as done or superseded.
#16is the only open issue. - v2.2.0 —
next-appshipspnpm local:up, one command from a clone to a working login;parts/setup-wizard.mdnarrowed to deploy only, its--local-onlyflag removed. - v2.1.0 — CSS-only decided: token layers plus co-located CSS Modules. Tailwind and PostCSS are out of the scaffold.
- First consumer run (2026-07-18) scaffolded
prompt-smithend to end and returned three fixes, all now in the skill: thetypescript@^5pin, theserver-onlyvitest stub, and an inlinedtypography.css.
Up next: open issues are the ordered backlog. Four consumer runs remain outstanding, each shipped on reasoning alone — the aligned next-app (#18), local:up, the CSS-only conversion, and the storage part plus setup wizard, which have never executed. Every one of them fails silently if it fails: a scaffold that renders plausibly with a reset missing, a local:up re-run that quietly rewrites AUTH_SESSION_SECRET and signs everyone out, a surviving utility class that produces unstyled output rather than an error. Reading them once is not the gate; running them is.