Social bookmarking with editorial sensibility. A modern reimagining of del.icio.us.
🔖 Live: https://onlylinks.id
- ✅ Save and organize links with tags (not folders)
- ✅ Search across your entire collection
- ✅ Follow other curators and see their bookmarks
- ✅ Public/private bookmark visibility
- ✅ Fast, keyboard-driven interface
- ✅ Automatic Open Graph image fetching
- ✅ User profiles with avatars
- ✅ Responsive design (desktop + mobile)
- Node.js + Express
- SQLite database
- JWT authentication with httpOnly cookies
- Bcrypt password hashing
- Helmet security headers + CSP
- Rate limiting on auth endpoints
- Vanilla JavaScript (ES6+)
- Component-based architecture
- OKLCH color system
- CSS animations with reduced-motion support
- No frontend framework dependencies
- Node.js 20+
- npm or yarn
# Clone repository
git clone https://github.com/kardelly/only-links.git
cd only-links
# Install dependencies
npm install
# Create .env file
cp .env.example .env
# Edit .env and add JWT_SECRET (generate with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))")
# Start development server
npm start
# Open browser
open http://localhost:3000See DEPLOY.md for complete VPS deployment guide.
Quick deploy checklist: START-HERE.md
.
├── server.js # Express server + API routes
├── database.js # SQLite database + queries
├── public/
│ ├── index.html # Landing page
│ ├── app.html # Main application
│ ├── profile.html # User profiles
│ ├── settings.html # Account settings
│ ├── app.js # Main app logic
│ ├── profile.js # Profile page logic
│ ├── settings.js # Settings page logic
│ └── components/ # Reusable UI components
│ ├── header.js
│ ├── header.html
│ ├── sidebar-tags.js
│ ├── bookmark-renderer.js
│ └── *.css
├── PRODUCT.md # Product vision + principles
├── DESIGN.md # Design system tokens
├── SECURITY.md # Security hardening guide
├── PRIVACY.md # Privacy policy
├── DEPLOY.md # Deployment guide
└── package.json
- Speed is a feature – Every interaction feels instant
- Tags > folders – Multidimensional organization
- Public by default – Discovery through shared knowledge
- Keyboard > mouse – Every action has a shortcut
- Content first – UI recedes when not needed
Full philosophy: PRODUCT.md
- ✅ JWT tokens with 7-day expiration
- ✅ Bcrypt password hashing (10 rounds)
- ✅ Rate limiting (5 attempts/15min on auth)
- ✅ Content Security Policy (CSP)
- ✅ HTTPS-only cookies in production
- ✅ Input validation on all endpoints
- ✅ SQL injection prevention (parameterized queries)
- ✅ XSS protection
See SECURITY.md for hardening guide.
POST /api/auth/register- Create accountPOST /api/auth/login- LoginPOST /api/auth/logout- LogoutGET /api/auth/me- Get current user
GET /api/bookmarks- List bookmarks (with filters)POST /api/bookmarks- Create bookmarkPUT /api/bookmarks/:id- Update bookmarkDELETE /api/bookmarks/:id- Delete bookmarkGET /api/metadata?url=- Fetch Open Graph metadata
GET /api/tags- Get popular tags
GET /api/users/:username- Get user profilePOST /api/users/:username/follow- Follow userDELETE /api/users/:username/follow- Unfollow userGET /api/users/:username/followers- Get followersGET /api/users/:username/following- Get following
GET /api/settings/preferences- Get preferencesPUT /api/settings/preferences- Update preferencesPUT /api/settings/username- Change usernamePUT /api/settings/email- Change emailPUT /api/settings/password- Change passwordPOST /api/settings/avatar- Upload avatarDELETE /api/settings/avatar- Remove avatarDELETE /api/settings/account- Delete account
- users - User accounts (username, email, password_hash, avatar)
- bookmarks - Saved links (url, title, description, og_image, is_public)
- tags - Tag definitions (name)
- bookmark_tags - Many-to-many (bookmark_id, tag_id)
- follows - Social graph (follower_id, following_id)
- user_preferences - Settings (default_public)
All foreign keys have ON DELETE CASCADE for data integrity.
N- New bookmark (when not typing)Esc- Close modal- More coming soon...
# Required
NODE_ENV=production
JWT_SECRET=your-64-char-secret-here
# Optional (with defaults)
PORT=3000
ALLOWED_ORIGINS=https://onlylinks.id
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX_REQUESTS=5Generate strong JWT_SECRET:
node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"This is a personal project, but feel free to:
- Report bugs via Issues
- Suggest features via Discussions
- Fork and experiment
MIT License - See LICENSE
- Inspired by the original del.icio.us (2003-2017)
- Design philosophy influenced by Pinboard, Linear, and Are.na
- Built with the impeccable design system
- Website: https://onlylinks.id
- Email: privacy@onlylinks.id
- GitHub: @kardelly
Made with 🔖 by Anderson Cardelli Façanha