dsoft.services

The site itself is a small project: static Astro, hand-tuned B612 typography, no client-side framework getting in the way of content. But what’s underneath it turned into its own case study — running an entire small-business stack on Cloudflare’s free tier, instead of the usual pile of separately-billed AWS/Azure/GCP services.

One Cloudflare account currently covers: the Worker serving the static build plus a thin /api/contact handler, Turnstile for spam-proofing the contact form, Web Analytics with automatic edge-injection (no code, no cookies, discovered already running on the zone before it was ever explicitly set up), and Email Routing for the inbox behind it. No per-request metering to think about, no separate bill per 64k of something.

The contact form itself is layered against scraping (honeypot field, timing trap, Origin check, Turnstile gating the actual send) and the site carries a GDPR privacy policy written from that implementation, not a template — see the first post on this blog for the detail on both. Deploys go through Cloudflare’s versioned rollout: upload a version, verify it, then promote it to production traffic, with a separate stable preview environment for testing changes before they go live.