Hireloop — Launch a Production-Grade Job Board on Next.js 15 + Postgres + Drizzle

A self-hostable, MIT-licensed job board built on Next.js 15 (App Router), React 19, Postgres 16, and Drizzle ORM. Ships with bcrypt + opaque-session auth, email verification, password reset, self-serve account deletion (GDPR), admin moderation, rate limiting on every auth endpoint, security headers, structured logging, health probes, an optional Sentry hook, and a Playwright E2E suite that round-trips the verify-email and password-reset flows through Mailpit in CI. Built for founders launching a niche job board, agencies shipping white-label hiring portals for clients, and companies building internal hiring sites that want first-party data instead of paying LinkedIn.

Why you need this MVP

Job boards are a proven, durable business model — Indeed, LinkedIn Jobs, We Work Remotely, Y Combinator's Work at a Startup, AngelList Talent. They scale on inventory (listings) and audience (candidates), and they monetise via featured listings, employer subscriptions, or per-post fees once you reach scale.

The hard parts are the boring ones: auth that won't get you breached, rate limits that survive launch on Hacker News, account-deletion flows that satisfy GDPR, admin tooling for spam moderation, the SEO scaffolding that gets you into Google for Jobs, and the operational baseline (health checks, structured logs, request IDs) that makes a 3 AM incident debuggable. Most "starter" job board templates skip all of that.

Hireloop ships the boring parts as a finished baseline. You add your niche, your seed listings, your branding, and you have a real product on day one — not a 6-month checklist.

Key benefits

• Custom auth done right. bcryptjs work-factor-12 password hashes. Opaque session tokens: random bytes in an HttpOnly cookie, only sha256(token) stored in user_sessions. A leaked DB row can't be replayed as a cookie. 30-day sliding expiry.
• Email verification + password reset. Atomic UPDATE … RETURNING token consumption means single-use tokens with replay protection at the database level, not just the application.
• Self-serve account deletion (GDPR). Closes every owned posting, scrubs PII on the user row (email, displayName, password hash), revokes every session. Soft-delete keeps foreign-key integrity intact for audit.
• Self-serve password change. Verifies the current password, hashes the new one, revokes every other session, mints a fresh one for the caller so they aren't logged out of their own browser.
• Rate limiting on every auth endpoint. Sliding-window in-memory limiter, sign-in 10/15min/IP + 5/15min/email; sign-up 5/h/IP; reset 3/h/IP+email; verify-resend 5/h/user; password-change 5/h/user. 429 responses include Retry-After.
• Security headers in next.config.ts. HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy, and a tight CSP — applied to every route.
• Admin moderation console. Suspend, demote, delete users; close or hard-delete postings; suspension invalidates every session of the target user immediately.
• Structured JSON logger + request IDs. Pino-compatible shape, AsyncLocalStorage-backed request context, every API response carries x-request-id. Sanitised 500s so Drizzle / Postgres internals never leak through the response body.
• Health + readiness probes. /api/health (liveness, no DB hit) and /api/ready (SELECT 1 against Postgres, 503 on failure) for any load balancer or orchestrator.
• Sentry integration point. One env var (SENTRY_DSN) away. The SDK is dynamically imported so a deploy without it pays zero runtime cost.
• Email transports. Resend in production, nodemailer + SMTP (Mailpit) in dev and CI, stderr dry-run as a fallback with zero third-party setup.
• SEO-ready listings. Per-listing schema.org JobPosting JSON-LD (Google for Jobs ready), canonical URLs on every detail page, sitemap, robots disallow on every gated route, generated 1200×630 OG image.
• Tests cover the boring parts. 80 unit tests (Vitest) + integration suite against an ephemeral Postgres (testcontainers) + Playwright E2E that round-trips the verify-email and password-reset flows through Mailpit.
• CI does the work. GitHub Actions boots postgres:16-alpine + axllent/mailpit:v1.21 services and runs lint → typecheck → unit → migrate → integration → seed → build → bundle-size budget → Playwright → postgres logs on failure.

How to make money with it

• Launch a niche job board — frontend, climate-tech, web3, designers, founding engineers, remote-only, Spanish-speaking LATAM, Berlin startups, etc. Charge employers $99–$299 per post once you have inventory.
• Sell employer subscriptions with unlimited listings, featured placement, or a custom company page.
• Run a white-label hiring portal for a community, conference, or industry association — they bring the audience, you bring the platform.
• Build a regional hiring site for a country or city that LinkedIn under-serves.
• Operate an internal hiring portal for a company that wants first-party candidate data rather than feeding LinkedIn's funnel.
• Add applicant tracking as a premium tier (Hireloop deliberately leaves ATS out of v1 — you can add it as a pay-walled extension).
• Charge for featured listings that pin to the top of /jobs for a week.
• License the platform to recruiters, agencies, or HR consultancies as a managed service.
• Layer in resume hosting + outreach tooling once you have employer demand.
• Sell the codebase itself as an MVP, fork, or whitelabel deal.

How you can use it

• Indie founders launching a niche or regional job board
• Agencies shipping white-label hiring portals for clients
• Community organisers building a jobs page for a conference, newsletter, or Discord
• Internal hiring teams wanting their own first-party hiring portal
• Recruiters building a candidate-facing brand site
• Industry associations offering a member-only jobs feed
• Bootcamps and education providers with a graduate placements board
• Developers learning modern Next.js + Postgres + auth-from-scratch patterns
• Educators teaching production hardening (rate limits, sessions, GDPR, observability)

How it boosts your productivity

A "complete" job board, in the boring details, is 3 to 6 months of work beyond the obvious CRUD. Hireloop does that work for you.

• Auth done. You don't reach for NextAuth or Clerk, you don't run Supabase Auth, you don't pay per MAU — you own the auth layer end to end.
• GDPR and account-deletion done. Hard to bolt on after the fact; here from day one.
• Rate limits done. No surprise outage from a sign-up endpoint hammered by a bot.
• Admin moderation done. Suspension immediately revokes every session.
• Operational hygiene done. Structured logs, request IDs, health checks, sanitised errors, bundle budget — the deploy checklist is already short.
• CI pipeline done. GitHub Actions runs the lot — even the email round-trip through Mailpit.
• SEO done. Per-listing JSON-LD, canonical URLs, sitemap, robots, OG. Google for Jobs is a config flip away.
• Tests cover the right things. Not 100% coverage theatre — the auth flows, the filter logic, the salary parsing, the JSON-LD generation, and the email round-trip.

For a solo founder, this is the difference between launching a job board this quarter and still wiring auth next quarter.

What is included

• Next.js 15 App Router with React 19 + TypeScript, server components by default
• Drizzle ORM + Postgres 16 with checked-in migrations
• Tailwind v4 + shadcn/ui design system
• Custom auth — bcryptjs WF 12 + opaque sessions (sha256 in DB, raw bytes in HttpOnly cookie)
• Email verification + password reset with atomic single-use tokens
• Self-serve account deletion (GDPR-aligned soft-delete with PII scrub)
• Self-serve password change with global session revoke
• Admin moderation console for users + listings
• Rate limiting on every auth endpoint (per IP / per email / per user)
• Security headers (HSTS, CSP, X-Frame-Options DENY, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
• Structured logger + AsyncLocalStorage request context
• withApi handler wrapper — request ID, entry/exit logs, sanitised 500s
• /api/health (liveness) + /api/ready (DB readiness, 503 on failure)
• Sentry integration point (dynamic import, conditional on SENTRY_DSN)
• Email transports: Resend (prod), SMTP/nodemailer (Mailpit, dev/CI), stderr dry-run
• Per-listing schema.org JobPosting JSON-LD (Google for Jobs)
• Canonical URLs, sitemap, robots, OG image
• Bundle-size budget enforced in CI
• Privacy, Terms, Contact pages with explicit reseller/counsel-review callouts
• 80 unit tests (Vitest), integration tests (testcontainers Postgres), Playwright E2E (including Mailpit-backed email round-trip)
• CI pipeline (postgres + Mailpit services, full lint → build → E2E)

Tech stack at a glance

• Languages: TypeScript end to end
• Frontend: Next.js 15 (App Router) + React 19
• UI: Tailwind CSS v4, Radix UI, shadcn/ui
• DB: PostgreSQL 16 + Drizzle ORM (+ drizzle-kit migrations)
• Auth: Custom — bcryptjs + opaque sessions
• Email: Resend (prod), Nodemailer + SMTP (dev/CI via Mailpit), stderr dry-run
• Validation: Zod
• Observability: Structured logger, optional Sentry
• Testing: Vitest (unit + integration via @testcontainers/postgresql), Playwright (E2E + Mailpit round-trip)
• CI: GitHub Actions with postgres + Mailpit services

Ideal for founders launching a niche or regional job board, agencies building white-label hiring portals, companies running internal hiring sites, and developers learning a modern Next.js + Postgres + auth-from-scratch stack with the operational hygiene of a real production app.