Show Lemmy: I built a free streaming site from scratch — vanilla JS, Node.js, MongoDB, $0/month stack (eli6movies.vercel.app)

submitted 3 weeks ago* (last edited 3 weeks ago) by eli6@lemmy.world to c/webdev@lemmy.world

16 comments fedilink hide all child comments

Built ELI6 Movies as a side project to push how far a free-tier stack can go.

Tech:

Frontend: pure HTML/CSS/vanilla JS on Vercel (free)
Backend: Node.js/Express on Render (free)
DB: MongoDB Atlas M0 (free)
Metadata: TMDB API
Video: third-party embeds with smart server failover

Interesting bits:

Multi-server failover via postMessage detection
Episode email notifier
Tiered TMDB cache
i18n (EN/IT/RU)
Android TV spatial navigation

→ Watch now

Happy to answer questions about the architecture.

all 20 comments

sorted by: hot top controversial new old

[-] python@lemmy.world 3 points 3 weeks ago

slop

[-] eli6@lemmy.world 1 points 3 weeks ago

[-] eli6@lemmy.world 1 points 3 weeks ago* (last edited 3 weeks ago)

sure, what specifically bothered you

[-] TragicNotCute@lemmy.world 2 points 3 weeks ago

Cool concept and that’s definitely the start of the Backrooms (saw it yesterday in theaters), so that’s cool. I will not be returning to the site because of the ads/malware being served.

When trying to seek on the movie, you get tons of pop ups with the classic VPN scare messages. No thanks.

[-] eli6@lemmy.world 2 points 3 weeks ago* (last edited 3 weeks ago)

haha thats just whatever movie was on the homepage when i took the screenshot, it pulls the backdrop from tmdb. enjoy the backrooms lol

[-] TragicNotCute@lemmy.world 4 points 3 weeks ago

I feel like you didn’t read my full comment. I’d love to see you address the malware and popups.

[-] eli6@lemmy.world 2 points 3 weeks ago* (last edited 3 weeks ago)

yeah you were right, my bad. embeds were calling window.open() and the sandbox let it through. removed allow-popups so they cant do that anymore, video still works fine. give it another try if you want

[-] eli6@lemmy.world 1 points 3 weeks ago

i did read it — popup fix is in now. removed allow-popups from the iframe sandbox so embeds cant open new tabs. worth retrying if you want

[+] ultimate_worrier@lemmy.dbzer0.com 2 points 3 weeks ago* (last edited 3 weeks ago)

[deleted]

[-] slazer2au@lemmy.world 2 points 3 weeks ago

Mate it worse then you think.

The repo
https://github.com/EliseyRotar/eli6_movies

Step 3 in the database setup.

Network Access → Allow Access from Anywhere (0.0.0.0/0) - required for Render's dynamic IPs

[-] eli6@lemmy.world 1 points 3 weeks ago

yeah same answer as the other comment — render free tier has no static IPs so you cant restrict by IP at all. strong credentials are the actual protection, not IP allowlisting

[-] slazer2au@lemmy.world 1 points 3 weeks ago

You can. Your AI slop just doesn't know how.

[-] eli6@lemmy.world 1 points 3 weeks ago* (last edited 3 weeks ago)

you are right, my bad. render publishes fixed CIDR ranges per region, you can get them from the dashboard and allowlist those in atlas instead of 0.0.0.0/0. updating the readme

[-] eli6@lemmy.world 1 points 3 weeks ago

popups came from the embed iframes, not the site itself. removed allow-popups from the sandbox so they cant do that anymore

[-] eli6@lemmy.world 1 points 3 weeks ago* (last edited 3 weeks ago)

popups were coming from window.open() inside the embed iframes, removed allow-popups from the sandbox so that cant happen anymore. should be good now

this post was submitted on 02 Jun 2026

4 points (100.0% liked)

WebDev

1351 readers

1 users here now

Community for all things Web Development related.

founded 3 years ago

MODERATORS

postman@lemmy.world