01
Architecture
npm-workspaces monorepo. Astro on Cloudflare Pages: seven surfaces, seven Pages projects. Shared token, UI, and MDX packages.
Astro
MDX
npm workspaces
TypeScript
Production stack
What this site is actually built on.
Verified from the repo, not from memory. Every layer below is in production today across wojciech.io and its subdomains. If a tool is on this page, it pays rent.
Push to production
01 · Source
GitHub
Monorepo, branch-protected main
02 · CI gate
GitHub Actions
Vitest · Playwright · Semgrep · CodeQL
03 · Build
Astro
Static + Pages Functions
04 · Deploy
Cloudflare Pages
Wrangler → 7 surfaces, only on green CI
05 · Edge
Cloudflare
CDN · WAF · rate limiting
Deploy only fires on green CI (workflow_run gate). No green, no ship.
7surfaces deployed
9languages shipped
734automated tests
10stack layers
The layers
02
Frontend
Tailwind CSS 4 driven by CSS custom-property tokens. Geist for type. Lenis + Motion for motion. Pagefind for static search.
Tailwind CSS
ViteGeistMotionPagefind
03
Infra
Cloudflare Pages Functions for gated surfaces. Workers for the growthhub cron. Terraform manages Pages projects and domains. Node 24 in CI.
Cloudflare Workers
Terraform
Node.js 24
04
Content & i18n
Astro content collections for insights, work, and testimonials. 9 languages across CV and SEO surfaces: 7 fully translated locale homepages on top of EN, plus Arabic from its own RTL pages.
Astro collections
MDX9 locales
05
Analytics
Nothing loads before consent, not one tag. PostHog on EU residency carries product analytics, GA4 sends pageviews only, Sentry catches errors. Cloudflare Web Analytics is wired but dormant: its token is unset, so no beacon is emitted.
PostHog
GA4
Sentry
06
Testing
Vitest for units and coverage. Playwright across Chromium + WebKit for smoke, SEO, a11y, and broken-link checks. Daily smoke against production.
VitestPlaywright
Lighthouse CI
07
CI/CD
CI on every push and PR. Deploy runs only on CI success via workflow_run, shipping site and subdomains in parallel through Wrangler. Commitlint enforced.
GitHub Actions
WranglerCommitlint
08
Security
Branch protection with required checks. Strict CSP, HSTS preload, XFO DENY. Auth gates use HMAC-SHA256 signed cookies with timing-safe compares and per-IP rate limiting.
SemgrepCodeQLgitleaksCSP · HSTS
09
Resilience
Azure Static Web Apps holds a weekly cold standby. Failover is operator-triggered, auto-detects health, then flips DNS via the Cloudflare API. Rollback is a non-destructive git revert.
Azure SWA
Cloudflare DNSBetterStack
10
Working method
Claude Code implements. Codex reviews. Strategy and go/no-go stay human. Merge once docs and code agree.
Claude CodeCodex
Next step
Want to see a piece of this in action
If something on the page is interesting in context of what you are building, write me and we will look at it together.