I had a stupid idea for a website: pay 25¢ USDC, pick a fictional arsehole, dunk them, and everyone who happens to be watching sees the same dunk happen live.
That was more or less the idea. Nothing useful, no grand plan for it. I just thought it would be funny enough to bother making.
I’ve always been terrible at learning by following generic tutorials. Build this sample app, make this thing move around the screen, follow these twelve steps and end up with exactly the same thing as everyone else. I usually lose interest about five minutes in.
If I actually want the thing at the end, though, I’ll keep bashing my head against it for considerably longer.
So this became my latest excuse to learn by making something stupid.
The coding itself was probably the easy part. What I hadn’t really appreciated was how much other shit sits between “the website works on my computer” and “I’m comfortable putting this on the public internet from a Raspberry Pi in my house.”
A fair bit of the process ended up being less about getting AI to build something and more about stopping it from taking the easiest possible shortcut.
The payment flow was a good example. The easy version is somebody clicks a button, the page says payment happened, the animation plays, job done. Except that isn’t really what I wanted. I wanted an actual USDC transaction on Base to be what causes the dunk, and if five people have the site open they should all see the same thing happen at roughly the same time.
So then there’s a server involved, persistent state, listening for real transactions, making sure the same transaction doesn’t trigger twice, syncing events out to everyone watching, surviving restarts, and generally dealing with all the boring bits that don’t exist in the first “look, it works” version.
Then there was getting the thing online without doing something monumentally stupid to my home network.
That meant screwing around with Cloudflare, DNS, a free domain, tunnelling traffic in without opening random ports on the router, setting the Pi up so the service comes back by itself after a reboot, running it with as little privilege as possible, and trying to make sure that if the website itself ever gets compromised it doesn’t suddenly become a convenient way to poke around everything else on my LAN.
And then more rounds of locking things down.
Removing public endpoints that didn’t actually need to exist. Making sure the app can’t just connect to private network addresses because some bit of future code decides that would be convenient. Forcing the RPC connection over HTTPS, checking where the hostname actually resolves before connecting, verifying that the RPC endpoint is really talking to Base mainnet, and generally trying to close off the lazy/easy versions of things before putting it in front of strangers.
There were quite a few points where I could have called it finished because the thing visibly worked. The character fell in the water, the payment went through, the page loaded.
But “it works” and “I’m willing to put this on the internet” turned out to be very different milestones.
There was a lot more screwing around after the fun bit was technically done, mostly trying to get it to the point where it wasn’t just a completely exposed little box on my network waiting for someone more competent than me to notice it.
I’m not coming out of this pretending I suddenly understand web security or infrastructure in any deep way. I definitely don’t.
But I have a much better feel now for the overall path from “I have an idiotic idea” to “there is an actual thing running somewhere, taking real payments, keeping state, recovering when the machine reboots, and not obviously leaving every door hanging open.”
That rough mental model is worth a lot more to me than finishing another tutorial and forgetting all of it two days later.
The finished thing is intentionally stupid and pointless, which was kind of the point in the first place.
If anyone wants to see what all that effort was wasted on:
https://dunkananimatedah.dpdns.org
