Our new website is live. This post is for readers who want to know how it is built.
No more WordPress
The site is now fully static, built with Astro 7. Every page is rendered to plain HTML at build time and served from a private S3 bucket behind CloudFront. There is no database, no PHP and no admin panel to patch.
The only code that runs on a request is the contact form. It is a Lambda function behind the same CloudFront distribution, guarded by Cloudflare Turnstile and a per-IP rate limit. For a cybersecurity firm, the smaller attack surface is the feature we like best.
Hardened by default
We use a strong Content Security Policy (CSP) configuration. CloudFront adds HSTS, X-Frame-Options, Referrer-Policy and Permissions-Policy. A Playwright suite tests that policy on every branch and blocks the pipeline when it fails.
Analytics load only after consent. Google Consent Mode starts with every signal denied.
An AI-friendly contribution workflow
The facts about OKIOK, our products and our services live in a reference folder in the repository, in plain Markdown. A binding style guide and a design system sit beside it. With those three, an AI assistant such as Claude Code can draft a page, hold it to the style guide and check the layout in a real browser.
Nothing ships without review. Every change goes through a merge request with its own preview URL. Build-time guards fail the build when a route breaks or a page drops out of llms.txt, the map we publish for answer engines.
Infrastructure as code
The whole hosting stack is an AWS CDK app in the same repository:
- The private bucket and the CloudFront distribution
- An edge function that serves every legacy WordPress URL as a 301 from a KeyValueStore
- The contact form’s Lambda function and its rate-limit table
- The IAM roles the pipeline assumes
GitLab CI deploys it with short-lived OIDC tokens, so no AWS access key is stored anywhere. The main branch goes to the test environment. Production waits behind a manual gate. The RAC/M Identity and S-Filer Portal documentation sites publish into the same bucket from their own repositories.
What about the fractals in the hero image of news and release posts?
Each one is a zoomed-in view of the Mandelbrot set, rendered live in WebGL. The view is seeded from the post’s URL. A post always gets the same image, and different posts get different images. Where the browser cannot draw WebGL, the header falls back to a plain dark band and the headline stays.
For fun, follow the “Explore this one” link under any fractal to open the explorer. Type your name, or anything else, in the seed box to get your own fractal. The URL follows you as you pan and zoom. Two to start from: a psychedelic one and Éric’s favourite. Found a particularly good one? Share its URL and tag us #okiok.