- Hosting
- Private S3 bucket (public access blocked, encrypted, versioned) readable only by CloudFront through Origin Access Control.
- CDN & TLS
- CloudFront with HTTPS redirect, HTTP/2 and HTTP/3, security headers (CSP, HSTS) and an ACM certificate in us-east-1.
- Infrastructure as code
- Terraform for S3, CloudFront, ACM, an index-rewrite function and the deploy role, validated in CI.
- CI/CD
- GitHub Actions runs CI on pull requests. Pushes to main rerun CI, publish the build with year-long caching for hashed assets, and invalidate CloudFront.
- Security
- GitHub OIDC federation into a role limited to one bucket and one distribution, so there are no long-lived AWS keys.
- AWS provisioningplanned
- terraform apply in the production AWS account.
- Custom domainplanned
- alibacelonia.dev pointed at CloudFront through Cloudflare DNS.