jstgtech.com — this site
A static blog and portfolio on Astro 7 + Tailwind 4, deployed to S3 + CloudFront with Terraform-managed infrastructure and full CI/CD.
The site you’re reading — built as a WordPress replacement that costs almost nothing to run and can’t be hacked in any of the usual WordPress ways, because there’s no server, no database, and no PHP: just static files on S3 behind CloudFront.
Stack
- Astro 7 with React islands only where interactivity earns its keep (theme toggle, blog search/filtering) — everything else ships as plain HTML.
- Tailwind CSS 4, configured CSS-first, with class-based dark mode.
- Content collections with Zod-validated frontmatter: invalid content fails the build, so bad metadata can never reach production.
- Sveltia CMS for visual editing, with a custom live preview template that matches the real site styles.
Infrastructure
Every piece of AWS is Terraform: the S3 buckets, the CloudFront distribution and its security-header policies (HSTS, CSP, frame-deny), the ACM certificate, Route 53 DNS, and the OIDC roles GitHub Actions assumes — no long-lived AWS keys anywhere. Terraform plans on every pull request and applies on merge.
Pretty URLs come from a CloudFront Function that rewrites /blog/post/ to
/blog/post/index.html, since the S3 REST origin only serves a root default
object. A strict CSP protects the site itself, while the CMS routes get a
relaxed policy so the editor can talk to GitHub and S3.
Quality gates
CI runs type-checking, a Vitest unit suite for the framework-free logic, and a full build on every PR; Lighthouse CI enforces accessibility and SEO scores of 90+ as hard gates. Dependabot keeps dependencies patched weekly.