Deconstructing this website

DNS is authoritative on Cloudflare, and the zone is signed with DNSSEC.

TLS 1.3 is the minimum version the zone accepts. Encrypted Client Hello is on. Clients that support it also get the post-quantum key agreement Cloudflare offers by default.

Always Use HTTPS redirects plain HTTP at the edge. The app sends HSTS with a one-year max-age, includeSubDomains and preload.

Workers Cache sits in front of the Worker and is tiered by default: a hit does not run the Worker.

A rendered page is cached at the edge only if it opts in. A response that declares no caching of its own is sent no-store.

Publishing an entry purges, by cache tag, its own pages and the pages that list it. Menus and settings are not purged; they expire within the hour.

Build output under /_astro/ is content-hashed and served with a one-year, immutable max-age.

Resized images are kept in the Cache API.

One Worker renders the pages on demand with Astro (SSR). The built files are served as Workers Static Assets without running it. There is no server behind the Worker.

The team that makes Astro has worked at Cloudflare since January 2026. Astro remains MIT-licensed and openly governed.

One middleware stamps 7 security headers on every page the Worker renders. The CSP admits one outside script and no other: the visit counter from Cloudflare.

The Worker knows the visitor's city and which Cloudflare data centre answered (request.cf). The edge-security opening shows them.

CMS plugins can run in their own Dynamic Worker, with no network of their own and fixed CPU, subrequest and time limits. Everything they do passes through a bridge that checks the capabilities each one declares.

D1 (SQLite) holds the content, its revisions and the settings. Each request opens a D1 session.

Workers KV holds the editors' sessions.

The photographs the page resizes go through the Images binding, which fits them to their slot and converts them to WebP. Everything else is served as it is in the repository.

R2 is wired as the CMS media store. Today every image on the site ships with the code.

Preview and production each have their own D1, Workers KV and R2.

One stylesheet declares every colour, radius and shadow, the column width and the spacing scale. CI rejects those values written anywhere else, except in marked blocks that imitate another product's interface.

Outside the site, the browser calls Cloudflare and nobody else: it downloads the Web Analytics script and sends it its measurements, with no cookies and identifying no one. Fonts, images and every other script are the site's own. Zaraz, Cloudflare's tag manager, loads on every page from this same domain and receives the answer you give in the cookie notice. If you accept analytics, it sends the visit to Google Analytics 4 from Cloudflare's servers: even then the browser never calls Google. If you decline, Google Analytics 4 never runs.

The fonts live in the repository, so building the site does not depend on Google Fonts. Cloudflare Fonts does not apply: it only rewrites links to Google Fonts, and there are none here.

Each vertical opens with a Wikimedia Commons photograph, restored and partly redrawn, and a layer drawn live in the browser. The layer is placed against the measured text, and its clock stops at eight seconds: nothing loops.

The photographs were restored locally with SeedVR2. FLUX.2 [dev] (Black Forest Labs) on Workers AI removed objects, extended frames and redrew from the photographs. Every prompt is in the repository.

The photographs are CC BY-SA, and the site credits them with the changes stated.

The cookie notice is the site's own. It is a card in the bottom-left corner, and the page keeps working behind it while you decide. Accept and Reject are two identical buttons, side by side. The notice has no close button and waits for your answer. “Cookie preferences”, in the footer, opens it again. Zaraz's own window is off because it blocks the whole page, and the cookie guide of Spain's data protection authority (AEPD) asks for less. It asks for Reject at the same level as Accept, a notice that stays until you answer, and withdrawal as easy as consent. Only your click passes the answer to Zaraz, through its consent API. Google Analytics 4 is not needed to count visits, since Web Analytics already does. It is here because this site is also a lab.

EmDash, the open-source (MIT) CMS that Cloudflare announced in April 2026, runs inside the same Worker.

Cloudflare runs its own blog on EmDash.

Five content types: pages, services, members, references and partners, with blog posts ready and empty. Pages and services have drafts; those two and members keep revisions. Bodies are Portable Text.

Two languages: pages, services and members are published in pairs linked by translationOf.

Menus, widget areas, site settings and taxonomies come from the CMS. Every interface label lives in a widget, not in a template.

Search comes from EmDash, on SQLite FTS5 with bm25 ranking.

The admin admits editors by passkey (WebAuthn) only: there is no password to store or leak.

EmDash is also an OAuth authorization server (the OAuth 2.1 profile: code + PKCE, dynamic client registration). So an AI agent can work on the content through its MCP server, with a token an editor grants.

The emdash command line signs in with the OAuth device flow (RFC 8628).

A plugin kept in the repository purges the cache on publish. It declares content:read, because without it EmDash skips its hooks.

The working repository is public, with all its commits.

Every change that can reach a page passes 27 steps that can fail. A test derives that number from the workflow.

The gates run the site locally on workerd, the open-source runtime behind Workers, through wrangler dev. If wrangler itself crashes, the stack restarts once and the summary says so.

When the gates pass on main, the preview deploys itself with wrangler-action. It waits for the D1 migrations, reseeds after rehearsing the SQL on a throwaway database, and runs a smoke battery.

Production deploys only when the founder starts it by hand, and a guard refuses to overwrite a database that holds content.

Every sentence the site renders lives in one versioned file, seed/seed.json. The service pages are written in Markdown, and the CMS converts them into that file. A test keeps the two word for word, and a CI gate rejects copy typed into a template.

On every change that can reach a page, CI builds the site and fills an empty database from that file, twelve times in parallel.

Service slugs are translated, so the other language's URL is never guessed. hreflang and the language switcher read the same resolved value.

The sitemap is generated from the CMS collections.

The accessibility, engine, design, layout, copy, language and naming checks plant the defect they hunt, and must catch it before they report green.

Lighthouse in CI, against a local copy, takes the median of 3 runs on 9 pages: performance ≥95; accessibility, best practices and SEO, 100. All nine met it on 2026-10-16.

Accessibility: axe (WCAG 2.2 A+AA) and a keyboard pass on every route of the site, plus reflow at 320 px. Where text sits on a photograph, contrast is measured on the rendered pixels.

Each opening is checked mid-animation and at rest, in Safari's engine (iPhone and desktop profiles) and Chrome's (Pixel 7), with reduced motion too.

The rendered text of 30 routes is frozen. Changing a word fails until the new text is deliberately re-captured, so the change shows in the pull request's diff.

AI agents write most of the code under written rules, and the founder merges every pull request.

Every push is scanned for secrets, and a guard rejects any client name not published under References.