Engineering a High-Performance Digital Outpost
Instead of deploying a generic theme to a managed hosting provider, I treated this platform like a mission-critical enterprise application. This project is a completely custom, self-architected static site and infrastructure monorepo built for speed, ironclad security, and a frictionless local developer experience.
What & Why
The goal was simple: Zero external themes, zero bloat, and absolute control over the stack.
By structuring the project as a monorepo containing both the frontend (/site) and the infrastructure as code (/infra), I practice the exact production-grade workflows I deploy for clients. This means automated staging environments, strict Content Security Policies, and credential-less CI/CD pipelines.
Architecture & System Design
| Component | Engineering Details |
|---|---|
The Application (/site) | Hugo & Tailwind CSS (Go templates and raw HTML/CSS). |
The Infrastructure (/infra) | Terraform managing private AWS S3 buckets behind a CloudFront CDN using Origin Access Control (OAC) |
The Pipelines (/.github) | GitHub Actions triggering independent AWS infrastructure and Hugo site deployments. |
Core Engineering Wins
- Zero-Trust AWS Deployment: The CI/CD pipeline relies entirely on OIDC (OpenID Connect) authentication. No long-lived AWS root keys or access tokens are ever stored in GitHub.
- Edge-Level Security: CloudFront Functions handle edge routing, injecting strict security headers (CSP, HSTS, X-Frame-Options) and managing dynamic URL rewrites for clean paths.
- Isolated Staging Environment: Pushing to a
stagingbranch instantly provisions a cloned environment (staging.stoicknight.com) - protected by IP restrictions and basic authentication - to safely validate changes before they hit production. - Frictionless Developer Experience: A
Justfileacts as a command center, abstracting environment verification (just doctor), local server spins, and infrastructure provisioning into single, predictable commands.
Technical Roadmap & TODOs
- Modernize Edge Compute (JS 2.0): Refactor the CloudFront Functions from the legacy ES5.1 runtime to the newer JS 2.0 runtime to leverage ES6 features (like
const,let, and arrow functions) for cleaner, more maintainable edge logic. - Migrate DNS to Cloudflare: Move authority from Route 53 to leverage apex CNAME flattening and consolidate the DNS control plane.
- Close the Visibility Gap: Implement lightweight CloudWatch dashboards and external uptime monitoring for proactive alerts (instead of waiting for an end-user to tell me it’s broken).
- Performance Tuning: Optimize the frontend build pipeline specifically to ace Core Web Vitals.
- Streamline the Content Pipeline: Strip out remaining friction from the local writing workflow to make deploying new posts completely seamless.