This website
Our own site, built the way we would build for a client, with measurable quality bars and a strict security policy.
Context
Gantrix is new, so our first case study is the site you are reading. Engineers judge a DevOps practice by how its own work is put together, so we treated the site like any client deliverable: written requirements and quality bars we could measure.
Problem
The brief had five requirements:
- Fast on a mid-range phone, with almost no JavaScript.
- Accessible to WCAG 2.2 AA, including keyboard-only use and reduced-motion preferences.
- A strict Content Security Policy, with no
'unsafe-inline'for scripts or styles. - No tracking and no third-party requests, so no cookie banner.
- Easy to update: adding a case study or an open-source contribution means adding one file.
Approach
- Static by default. Astro renders every page to plain HTML at build time. No framework runtime ships to the browser.
- Typed content. Case studies and contributions live in content collections with schemas, so a missing field fails the build instead of breaking a page.
- Security policy as code. Every page carries a CSP with SHA-256 hashes generated during the build. A verification script re-hashes every inline script and style in the output and fails if anything is not covered.
- Native page transitions. Navigation uses the browser’s View Transitions API, with no client-side router. Browsers without support simply navigate normally.
- Quality gates as scripts. Type checks, linting, a placeholder check, CSP verification and a size budget all run with one command, ready to move into CI.
Architecture
The build produces static HTML, CSS and a single small script, served from Cloudflare Pages.
Security headers (HSTS, frame protection, referrer and permissions policies) and cache rules are
set at the edge from a _headers file kept alongside the code. Content-hashed assets are cached
for a year; HTML is revalidated on every request, so a deploy takes effect at once.
Outcome
Measured on the first production build, 11 November 2026, by the scripts in the repository
(npm run verify) and a headless browser pass over every route:
| Measure | Budget | Result |
|---|---|---|
| Our JavaScript, gzipped | 15 KB | 1.2 KB |
| Home page transfer, gzipped, with fonts | 300 KB | 67 KB |
| Pages with a hash-based CSP | All | 8 of 8 |
| Third-party requests | 0 | 0 |
| Console errors or CSP violations | 0 | 0 |
What we’d do next
- Publish the source and deploy automatically from Git on every push.
- Run Lighthouse CI on every pull request, with the budgets enforced as assertions.
- Verify the live security headers with an external scanner.