How do I create an image pixel for tracking email opens and clicks?

<img src='https://track.example.com/o/8ff21b95-903c-4cfa-a866-9d036509cab3.gif?sig=REPLACE_WITH_SIGNATURE'
     width='1' height='1' alt='' style='display:block;border:0;width:1px;height:1px' />

import express from 'express';
import crypto from 'crypto';

const app = express();
const gif = Buffer.from(
  'R0lGODlhAQABAPAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==',
  'base64'
);
const secret = process.env.TRACKING_SECRET;
if (!secret) throw new Error('Set TRACKING_SECRET before starting');

function sign(value) {
  return crypto
    .createHmac('sha256', secret)
    .update(value)
    .digest('hex')
    .slice(0, 32);
}

function validSignature(eventId, signature) {
  if (typeof signature !== 'string' || !/^[a-f0-9]{32}$/.test(signature)) {
    return false;
  }
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(sign(eventId), 'hex')
  );
}

app.get('/o/:eventId.gif', async (req, res) => {
  const eventId = req.params.eventId;
  if (!validSignature(eventId, req.query.sig)) return res.sendStatus(404);

  try {
    await recordOpen({
      eventId,
      userAgent: req.get('user-agent') || '',
      ip: req.ip,
      occurredAt: new Date()
    });
  } catch {
    console.error('Open event write failed');
  }

  res.set({
    'Content-Type': 'image/gif',
    'Cache-Control': 'no-store, no-cache, must-revalidate, private',
    'Pragma': 'no-cache',
    'Expires': '0'
  });
  res.end(gif);
});

app.listen(3000);

app.get('/c/:eventId', async (req, res) => {
  const eventId = req.params.eventId;
  if (!validSignature(eventId, req.query.sig)) return res.sendStatus(404);

  const target = await findTargetUrl(eventId);
  if (!target) return res.sendStatus(404);

  try {
    await recordClick({
      eventId,
      userAgent: req.get('user-agent') || '',
      ip: req.ip,
      occurredAt: new Date()
    });
  } catch {
    console.error('Click event write failed');
  }

  res.set({ 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer' });
  res.redirect(302, target.url);
});

create table email_tracking_ids (
  event_id uuid primary key,
  campaign_id uuid not null,
  recipient_id uuid not null,
  message_id uuid not null,
  event_type varchar(10) not null check (event_type in ('open', 'click')),
  target_url text,
  first_seen_at timestamptz,
  last_seen_at timestamptz,
  open_count integer not null default 0,
  click_count integer not null default 0,
  last_user_agent text,
  last_ip inet
);