A personal site, entirely as code

A personal site needs almost nothing. That is a good reason to do it properly: if the whole chain fits in one repository, you can read it in ten minutes.

A Worker with no script

Cloudflare Workers can serve static files directly, with no code running at all. So the complete Worker configuration is this:

{
  "name": "portfolio",
  "assets": {
    "directory": "./dist",
    "html_handling": "auto-trailing-slash",
    "not_found_handling": "404-page"
  }
}

Astro produces dist/, wrangler deploy uploads it, and that is all. No function to maintain, no cold start, and the security headers live in a _headers file versioned with everything else.

Who owns what

The only mildly interesting architecture decision is the boundary between two tools that can both talk to Cloudflare.

• Wrangler owns the Worker and its custom domains. Those change with the site’s code.
• Terraform owns the zone: minimum TLS version, HSTS, the redirect from www to the apex. Those almost never change, and you want to review them before touching them.

No resource is managed by both. That rule is what stops a terraform apply from undoing what a deployment just did.

A content security policy with no exceptions

Astro hashes every script and stylesheet it emits and writes the matching policy into the page. So there is no unsafe-inline and no allow-list of third-party domains: the site loads nothing that does not come from itself, fonts included.

The revision in the title block

The footer is drawn like the title block of a technical drawing, and its “Revision” cell holds the commit that produced the page. It is a detail, but it sums up the idea: what you are reading corresponds to one exact state of the repository.