The site runs on the same cluster as the trading platform and ships through the same pipeline. I wanted the site claiming I build things to be the one I built.
No framework
One Python script generates every page. All the copy sits in a single JSON file, so changing the site means editing text and running python build.py. No npm, no bundler, nothing to keep patched.
The output is plain HTML and CSS. Fonts are self-hosted and the diagrams are drawn as SVG at build time instead of exported as images, so the page makes no external requests. That is what allows a content security policy of default-src 'self'.
The container
First Python renders the site, then the result is copied into nginx. The running image is nginx-unprivileged with a read-only root filesystem.
It serves clean URLs, caches fingerprinted assets for a year, revalidates HTML on every request and sets the usual security headers. The headers took some care. nginx does not merge add_header across levels, so as soon as one location block sets a header it stops inheriting the others. They live in a snippet that every location includes.
How a change reaches the internet
I push to the repository and CI renders the site, then runs three checks on the output before anything gets built.
One fails the build if a page references a file that is not there. One fails it if an em dash turns up anywhere. The third greps the rendered site for internal hostnames, private IP ranges and account figures. These pages were written from my own internal documentation, so that check exists to stop an address or a hostname reaching the public site by accident.
If all three pass, kaniko builds the image and pushes it to my registry. CI then commits the new image tag back to the repository and stops. It never touches the cluster. ArgoCD picks up the commit and rolls the change out, the same way everything else on the cluster is deployed.
Serving it
Two replicas spread across separate hosts, rolling updates set so no pod goes away before its replacement is ready, and liveness and readiness probes on both.
Traffic arrives over a Cloudflare tunnel. The connector dials out from inside the cluster, meaning no public IP and no forwarded port. Cloudflare's edge certificate handles TLS, so there is no certificate here for me to renew.
Next is running the same connector in the second cluster on the same tunnel. Cloudflare then routes to whichever connectors are healthy, and losing a site stops meaning losing the website. Every pod serves identical files baked into the image, so there is no state to keep in sync and nothing to reconcile afterwards.
Was it necessary
No. A static host would serve these files for free.
The infrastructure was already running, and the checks earn their place. The leak guard has flagged real content during editing more than once.