Deconstructing this website

DNS is authoritative on Cloudflare, and the zone is signed with DNSSEC.

TLS 1.3 is the minimum version the zone accepts. Encrypted Client Hello is on. Clients that support it also get the post-quantum key agreement Cloudflare offers by default.

Workers Cache sits in front of the Worker and is tiered by default: a hit does not run the Worker.

A rendered page is cached at the edge only if it opts in. Every other rendered response is sent no-store.

Publishing an entry purges, by cache tag, its own pages and the pages that list it. Menus and settings are not purged; they expire within the hour.

Build output under /_astro/ is content-hashed and served with a one-year, immutable max-age.

Resized images are kept in the Cache API.

One Worker renders the pages on demand with Astro (SSR). The built files are served as Workers Static Assets without running it. There is no server behind the Worker.

The team that makes Astro has worked at Cloudflare since January 2026. Astro remains MIT-licensed and openly governed.

One middleware stamps 7 security headers on every page the Worker renders. The CSP admits no third-party script.

The Worker knows the visitor's city and which Cloudflare data centre answered (request.cf). The edge-security opening shows them.

CMS plugins can run in their own Dynamic Worker, with no network of their own and fixed CPU, subrequest and time limits. Everything they do passes through a bridge that checks the capabilities each one declares.

D1 (SQLite) holds the content, its revisions and the settings. Each request opens a D1 session.

Workers KV holds the editors' sessions.

The Worker hands each image to the Images binding, which resizes it to its slot and converts it to WebP.

R2 is wired as the CMS media store. Today every image on the site ships with the code.

Preview and production each have their own D1, Workers KV and R2.

One stylesheet declares every colour, radius and shadow, the column width and the spacing scale. CI rejects those values written anywhere else, except in marked blocks that imitate another product's interface.

Loading a page makes no third-party request. Fonts, scripts and images are all the site's own.

The fonts live in the repository, so building the site does not depend on Google Fonts. Cloudflare Fonts does not apply: it only rewrites links to Google Fonts, and there are none here.

Each vertical opens with a Wikimedia Commons photograph, restored and partly redrawn, and a layer drawn live in the browser. The layer is placed against the measured text, and its clock stops at eight seconds: nothing loops.

The photographs were restored locally with SeedVR2. FLUX.2 [dev] (Black Forest Labs) on Workers AI removed objects, extended frames and redrew from the photographs. Every prompt is in the repository.

The photographs are CC BY-SA, and the site credits them with the changes stated.

EmDash, the open-source (MIT) CMS that Cloudflare announced in April 2026, runs inside the same Worker.

Cloudflare runs its own blog on EmDash.

Five content types: pages, services, members, references and partners, with blog posts ready and empty. Pages and services have drafts; those two and members keep revisions. Bodies are Portable Text.

Two languages: pages, services and members are published in pairs linked by translationOf.

Menus, widget areas, site settings and taxonomies come from the CMS. Every interface label lives in a widget, not in a template.

Search comes from EmDash, on SQLite FTS5 with bm25 ranking.

A plugin kept in the repository purges the cache on publish. It declares content:read, because without it EmDash skips its hooks.

The working repository is public, with all its commits.

Every change that can reach a page passes 26 steps that can fail. A test derives that number from the workflow.

The gates run the site locally on workerd, the open-source runtime behind Workers, through wrangler dev. If wrangler itself crashes, the stack restarts once and the summary says so.

When the gates pass on main, the preview deploys itself with wrangler-action. It waits for the D1 migrations, reseeds after rehearsing the SQL on a throwaway database, and runs a smoke battery.

Production deploys only when the founder starts it by hand, and a guard refuses to overwrite a database that holds content.

Every sentence the site renders lives in one versioned file, seed/seed.json. The service pages are written in Markdown, and the CMS converts them into that file. A test keeps the two word for word, and a CI gate rejects copy typed into a template.

On every change that can reach a page, CI builds the site and fills an empty database from that file, twelve times in parallel.

Service slugs are translated, so the other language's URL is never guessed. hreflang and the language switcher read the same resolved value.

The sitemap is generated from the CMS collections.

The accessibility, engine, design, layout, copy, language and naming checks plant the defect they hunt, and must catch it before they report green.

Lighthouse in CI, against a local copy, takes the median of 3 runs on 9 pages: performance ≥95; accessibility, best practices and SEO, 100. All nine met it on 2026-10-16.

Accessibility: axe (WCAG 2.2 A+AA) and a keyboard pass on every route of the site, plus reflow at 320 px. Where text sits on a photograph, contrast is measured on the rendered pixels.

Each opening is checked mid-animation and at rest, in Safari's engine (iPhone and desktop profiles) and Chrome's (Pixel 7), with reduced motion too.

The rendered text of 30 routes is frozen. Changing a word fails until the new text is deliberately re-captured, so the change shows in the pull request's diff.

AI agents write most of the code under written rules, and the founder merges every pull request.

Every push is scanned for secrets, and a guard rejects any client name not published under References.