Broz Stays

• Property pages that answer everything

  Each stay carries a gallery, rooms and rates, amenities, meals, house policies, FAQs, a map and what is nearby — the questions guests used to ask over WhatsApp, answered on the page.

• Destinations as places, not filters

  Cities live at their own paths and group into the circuits guests actually book — the Dooars, the Old Silk Route — so a valley can sell before a specific house does.

• Destination-aware search

  The hero search knows the region, the cities inside it and every property in each, so a half-typed place name still lands somewhere useful.

• Enquiries, not a checkout

  Hosts confirm their own rooms, so the site captures a numbered enquiry and hands off to WhatsApp rather than pretending to hold inventory it cannot see.

• Host and career lead capture

  “List your property” and the careers form — CV upload included — drop straight into the panel’s inbox instead of an email account nobody owns.

• Built to be found

  Per-property SEO fields, structured data on every listing, and image handling that serves modern formats at the size the layout actually needs.

That is the design the build was signed off from, embedded here because the production site refuses to be framed by another domain. For the real thing, open brozstays.com.

• A sectioned property editor

  A property is not one form. It breaks into thirteen sections the team edits independently, so changing a check-out time never risks the gallery.

• Image manager

  Upload, reorder and pick the cover photo per property and per room. Originals are resized on the server rather than shipped at 3 MB.

• Enquiry threads

  Every enquiry gets a reference number and keeps its reply history, so any team member can pick up a conversation someone else started.

• Reviews held for approval

  Guest reviews sit in a pending queue and only reach a property page once someone publishes them.

• The site’s own menus, editable

  Navigation and footer are a drag-ordered tree in the panel — a new destination goes into the menu without a developer.

• Its own subdomain, gated

  The panel answers only on admin.brozstays.com, behind a session check that runs at the edge before any page renders. On the public domain it does not exist at all.

A clickable walkthrough of the panel, with sample data — the real one at admin.brozstays.com is behind the client's sign-in, as it should be.

• One app, two sites

  Middleware reads the Host header and mounts the panel at the root of the admin subdomain. One build, one process, one deploy — and brozstays.com/admin returns a real 404 rather than a redirect that admits the panel is there.

• Self-hosted, end to end

  PostgreSQL on the same VPS bound to loopback, the app under PM2, nginx in front with a Let's Encrypt certificate covering all three hostnames. No per-seat SaaS bill sitting under the site.

• Sessions that hold up

  Passwords hashed with bcrypt, an HS256 token in an httpOnly cookie scoped to the admin host, verified in Edge middleware with Web Crypto — so the check happens before a page renders, not after.