Build Log: OXAUS // HUB — A Flat-File Transmission System (v1.0)
We live in an era of infinite scroll, algorithmic feeds, and engagement metrics. I wanted somewhere quiet. Somewhere the end of the page is a real event, and what you write matters more than how many people click it.
So, I built OXAUS // HUB.
This is a flat-file community forum. No tracking. No ads. No bloated Node.js frameworks, no NPM install wait times, and no heavy CMS dependencies. Just pure PHP, a single SQLite database file, and vanilla JavaScript. It runs on standard cPanel shared hosting. It loads in milliseconds.
// SYSTEM SPECS
Backend: PHP 8+ (PDO)
Database: SQLite 3 (Single Flat File)
Frontend: HTML5, CSS3, Vanilla JS
Auth: Session-based, bcrypt hashed, CSRF protected
Dependencies: 0 (No Composer, No NPM, No build step)
=========================================
1. THE DATABASE & ARCHITECTURE
=========================================
Instead of spinning up a MySQL database and configuring users/privileges, the entire data layer is handled by a single `forum.db` file sitting in a protected `/data/` directory. PHP uses PDO (PHP Data Objects) to interact with it.
The schema is lean:
- users (id, username, password_hash, role, bio, website, github, social, status)
- forums (id, slug, name, description, position)
- threads (id, forum_id, user_id, title, body, views, pinned, locked, edited_at)
- posts (id, thread_id, user_id, body, edited_at)
- invites (id, code, created_by, used_by, status)
- notifications (id, user_id, type, message, link, is_read)
To protect the database from being downloaded by scrapers, a single `.htaccess` file with `Deny from all` sits in the data folder. If your host supports it, you are completely secure.
Because it's SQLite, database migrations are done safely on the fly. When I pushed the update to allow users to add their website and social links, the PHP script simply checked if the columns existed, and if not, ran `ALTER TABLE users ADD COLUMN...`. No downtime, no command line.
=========================================
2. ROUTING & DEPLOYMENT
=========================================
The forum isn't in the root directory; it lives in a subfolder (`/hub/`). To make sure every asset, CSS file, and internal link resolved correctly without hardcoding the URL, the config file auto-detects the base path by comparing the application root to the server's document root.
This means you can pick up the entire folder, drop it into another subdomain or directory on any cPanel host, and it will just work without changing a single line of code.
=========================================
3. SECURITY IMPLEMENTATION
=========================================
Security was non-negotiable for an invite-only community.
- PASSWORDS: Stored using PHP's native `password_hash()` with bcrypt. Never plain text.
- CSRF PROTECTION: Every single form (login, reply, edit, admin actions) requires a CSRF token. A cryptographically secure token is generated per session and verified on POST. If a malicious site tries to trick your browser into submitting a form here, it fails.
- SESSIONS: Configured with `httponly` and `samesite: Lax` to prevent cross-site scripting (XSS) attacks from stealing your session.
- ROLE-BASED ACCESS: The system distinguishes between `member` and `admin` roles. Admins get the Node Control panel; members just get the loop.
=========================================
4. THE ADMIN NODE & MODERATION
=========================================
Admins have a full dashboard to manage the grid:
- Channels: Create, edit, reorder, or delete channels.
- Members: Promote to admin, demote, or ban/unban.
- Invites: Generate 1 to 20 codes at a time, attach a note to remember who it was for, and revoke unused codes.
The Moderation system is contextual. When viewing a thread, admins see a control panel at the bottom of the original post. They can:
- Pin/Unpin threads.
- Lock/Unlock threads (prevents new replies).
- Delete threads entirely.
But the most complex feature is the **Move Thread** system. If a user posts a Raspberry Pi question in the Web Dev channel, an admin can select the correct channel from a dropdown, type a "reason/warning", and hit move.
The database updates the `forum_id`, and the system automatically generates a notification. The user checks their inbox (the RTC link in the top nav) and sees: *"Your thread 'X' was moved to SBCs. Reason: This is hardware related, not web dev."*
=========================================
5. EDITABLE TRANSMISSIONS
=========================================
Users can edit their own threads and replies. Admins can edit anything.
When a post is edited, the database logs the timestamp, and the UI displays a subtle magenta "(edited)" marker next to the time. Edits don't hide mistakes; they show you corrected them transparently.
=========================================
6. THE FRONTEND INTERFACE
=========================================
I initially built this with an editorial, linen-paper zine aesthetic, but decided it needed to match my main blog. The frontend was completely rewritten for a dark cyberpunk terminal vibe.
- A near-black background (#08090c) with a faint cyan grid overlay.
- A CRT scanline animation drifting down the screen.
- A custom cursor (a 6px green dot with a trailing ring) using `mix-blend-mode: difference` so it inverts colors over text.
- Typography: Oswald (weight 200) for massive headlines, JetBrains Mono for all UI chrome, metadata, and terminal-style elements.
The reply system uses the Fetch API. When you transmit a reply, JavaScript intercepts the form submission, sends the data via AJAX, and injects the new reply directly into the DOM. No page reloads. It just fades into place.
=========================================
7. TEXT-ONLY PROFILES
=========================================
No avatars. "What you've written is what you look like."
Users get a 500-character bio and exactly three link slots: Website, GitHub, and one Social link. They render as `[ WEBSITE ]` terminal buttons. That's it. No link trees, no profile banners, no clout farming.
=========================================
THE INDEX
=========================================
Six channels. No subforums. No nesting.
- The Hub (Off-Topic)
- Single Board Computers (SBCs)
- Microcontrollers & Embedded
- Web Dev & Hosting
- Software & Coding
- Ethical Hacking & Pentesting
- DIY Projects & Builds
This is version 1.0. The database is initialized, the grid is live, and the first invites are being issued.
Read the manifesto below the feed to understand the rules of engagement.
Welcome to the loop. Refuse the feed.
So, I built OXAUS // HUB.
This is a flat-file community forum. No tracking. No ads. No bloated Node.js frameworks, no NPM install wait times, and no heavy CMS dependencies. Just pure PHP, a single SQLite database file, and vanilla JavaScript. It runs on standard cPanel shared hosting. It loads in milliseconds.
// SYSTEM SPECS
Backend: PHP 8+ (PDO)
Database: SQLite 3 (Single Flat File)
Frontend: HTML5, CSS3, Vanilla JS
Auth: Session-based, bcrypt hashed, CSRF protected
Dependencies: 0 (No Composer, No NPM, No build step)
=========================================
1. THE DATABASE & ARCHITECTURE
=========================================
Instead of spinning up a MySQL database and configuring users/privileges, the entire data layer is handled by a single `forum.db` file sitting in a protected `/data/` directory. PHP uses PDO (PHP Data Objects) to interact with it.
The schema is lean:
- users (id, username, password_hash, role, bio, website, github, social, status)
- forums (id, slug, name, description, position)
- threads (id, forum_id, user_id, title, body, views, pinned, locked, edited_at)
- posts (id, thread_id, user_id, body, edited_at)
- invites (id, code, created_by, used_by, status)
- notifications (id, user_id, type, message, link, is_read)
To protect the database from being downloaded by scrapers, a single `.htaccess` file with `Deny from all` sits in the data folder. If your host supports it, you are completely secure.
Because it's SQLite, database migrations are done safely on the fly. When I pushed the update to allow users to add their website and social links, the PHP script simply checked if the columns existed, and if not, ran `ALTER TABLE users ADD COLUMN...`. No downtime, no command line.
=========================================
2. ROUTING & DEPLOYMENT
=========================================
The forum isn't in the root directory; it lives in a subfolder (`/hub/`). To make sure every asset, CSS file, and internal link resolved correctly without hardcoding the URL, the config file auto-detects the base path by comparing the application root to the server's document root.
This means you can pick up the entire folder, drop it into another subdomain or directory on any cPanel host, and it will just work without changing a single line of code.
=========================================
3. SECURITY IMPLEMENTATION
=========================================
Security was non-negotiable for an invite-only community.
- PASSWORDS: Stored using PHP's native `password_hash()` with bcrypt. Never plain text.
- CSRF PROTECTION: Every single form (login, reply, edit, admin actions) requires a CSRF token. A cryptographically secure token is generated per session and verified on POST. If a malicious site tries to trick your browser into submitting a form here, it fails.
- SESSIONS: Configured with `httponly` and `samesite: Lax` to prevent cross-site scripting (XSS) attacks from stealing your session.
- ROLE-BASED ACCESS: The system distinguishes between `member` and `admin` roles. Admins get the Node Control panel; members just get the loop.
=========================================
4. THE ADMIN NODE & MODERATION
=========================================
Admins have a full dashboard to manage the grid:
- Channels: Create, edit, reorder, or delete channels.
- Members: Promote to admin, demote, or ban/unban.
- Invites: Generate 1 to 20 codes at a time, attach a note to remember who it was for, and revoke unused codes.
The Moderation system is contextual. When viewing a thread, admins see a control panel at the bottom of the original post. They can:
- Pin/Unpin threads.
- Lock/Unlock threads (prevents new replies).
- Delete threads entirely.
But the most complex feature is the **Move Thread** system. If a user posts a Raspberry Pi question in the Web Dev channel, an admin can select the correct channel from a dropdown, type a "reason/warning", and hit move.
The database updates the `forum_id`, and the system automatically generates a notification. The user checks their inbox (the RTC link in the top nav) and sees: *"Your thread 'X' was moved to SBCs. Reason: This is hardware related, not web dev."*
=========================================
5. EDITABLE TRANSMISSIONS
=========================================
Users can edit their own threads and replies. Admins can edit anything.
When a post is edited, the database logs the timestamp, and the UI displays a subtle magenta "(edited)" marker next to the time. Edits don't hide mistakes; they show you corrected them transparently.
=========================================
6. THE FRONTEND INTERFACE
=========================================
I initially built this with an editorial, linen-paper zine aesthetic, but decided it needed to match my main blog. The frontend was completely rewritten for a dark cyberpunk terminal vibe.
- A near-black background (#08090c) with a faint cyan grid overlay.
- A CRT scanline animation drifting down the screen.
- A custom cursor (a 6px green dot with a trailing ring) using `mix-blend-mode: difference` so it inverts colors over text.
- Typography: Oswald (weight 200) for massive headlines, JetBrains Mono for all UI chrome, metadata, and terminal-style elements.
The reply system uses the Fetch API. When you transmit a reply, JavaScript intercepts the form submission, sends the data via AJAX, and injects the new reply directly into the DOM. No page reloads. It just fades into place.
=========================================
7. TEXT-ONLY PROFILES
=========================================
No avatars. "What you've written is what you look like."
Users get a 500-character bio and exactly three link slots: Website, GitHub, and one Social link. They render as `[ WEBSITE ]` terminal buttons. That's it. No link trees, no profile banners, no clout farming.
=========================================
THE INDEX
=========================================
Six channels. No subforums. No nesting.
- The Hub (Off-Topic)
- Single Board Computers (SBCs)
- Microcontrollers & Embedded
- Web Dev & Hosting
- Software & Coding
- Ethical Hacking & Pentesting
- DIY Projects & Builds
This is version 1.0. The database is initialized, the grid is live, and the first invites are being issued.
Read the manifesto below the feed to understand the rules of engagement.
Welcome to the loop. Refuse the feed.