Home on Kerim Kilic

This website: static hosting on AWS

Mon, 01 Jan 0001 00:00:00 +0000

Overview

This site is plain HTML built with Hugo and served from a private S3 bucket through CloudFront. The infrastructure is in terraform/, in the same repository as the site. The decisions behind it, and the places where AWS didn’t behave as I expected, are in the article How this website works.

How it’s set up

The S3 bucket blocks all public access. Only this CloudFront distribution can read it, through origin access control.
The certificate comes from ACM and is validated through DNS records that Terraform creates in Cloudflare.
A CloudFront Function handles clean URLs and redirects www to the bare domain, so there’s no server to run.
Security headers come from a CloudFront response headers policy.
GitHub Actions deploys by assuming a narrowly scoped IAM role through OIDC. No access keys are stored anywhere.
The dev site is a second copy of the same stack behind Cloudflare Access (Google sign-in or a one-time email code, allowlist only). Cloudflare adds a secret header that CloudFront checks, so nobody can go around the login through the raw cloudfront.net address.

Why static

A static site costs almost nothing, loads quickly and has nothing to patch. The downside is that anything dynamic, like a form or search, needs a separate service, and I don’t need either here. Production doesn’t sit behind Cloudflare the way dev does, so I run a smoke test against the live site after every infrastructure change to catch any difference.

How this website works

Sat, 03 Oct 2026 00:00:00 +0000

This site is about as small as a production system gets: a handful of HTML files, no database, no login. I still wanted to build it the way I would build something at work, for two reasons. The infrastructure is part of what I want to show, and the repository is public, so it has to be something I’m comfortable with people reading.

This article walks through how it fits together, the decisions behind it, and the few places where the platform doesn’t behave the way I expected. The full source is on GitHub.

Privacy

Mon, 01 Jan 0001 00:00:00 +0000

The short version: this site doesn’t collect anything about you.

What the site does

It sets no cookies and runs no analytics, advertising or tracking.
It loads no third-party scripts. The fonts and icons are served from this site itself, so your browser doesn’t contact Google or any other font or tracking service while you read a page.
It has no forms and nothing to sign up for.

When you visit

The pages are served by Amazon CloudFront (AWS), and the domain’s DNS is hosted by Cloudflare. Like any web host, they process your IP address to deliver the pages. I haven’t switched on access logging, so I don’t keep a record of who visited or what they read. AWS and Cloudflare handle the data they process under their own privacy terms.