Skip to content
gonçalo.fileno
← Back to the home page

This site

A bilingual CV site whose infrastructure and pipeline are part of the portfolio. It is a static Astro site on AWS, provisioned with Pulumi and Terraform and deployed from GitHub Actions without stored credentials.

  • Astro
  • TypeScript
  • Pulumi
  • Terraform
  • AWS
  • Cloudflare
  • GitHub Actions

Architecture

Runtime: visiting the site and sending a message
  1. Browser → Cloudflare DNS: resolve
  2. Browser → CloudFront: HTTPS
  3. Browser → Turnstile: token
  4. CloudFront → S3: /*
  5. CloudFront → API Gateway: /api/*
  6. API Gateway → Lambda
  7. Lambda → SES: send
  8. Lambda → Turnstile: verify token
  • Browser: Visitor
  • Turnstile: Bot check
  • CloudFront: HTTPS · headers
  • S3: Private, OAC
  • API Gateway: Rate limited
  • Lambda: Validates
  • SES: Email to me
  • cloudflare: Cloudflare DNS, Turnstile
  • aws: CloudFront, S3, API Gateway, Lambda, SES
Delivery: how the site and the AWS account are built
  1. GitHub → GitHub Actions: merge
  2. GitHub Actions → Pulumi: pulumi up
  3. GitHub Actions → Terraform: apply
  4. GitHub Actions → IAM: assume (OIDC)
  5. Pulumi → The site: provisions
  6. Terraform → IAM: creates
  7. Terraform → Budgets
  8. Terraform → CloudTrail
  9. Budgets → Email alerts: alert
  • GitHub: Pull request
  • GitHub Actions: Tests · gates
  • Pulumi: Site stack
  • Terraform: Account baseline
  • The site: S3 · CloudFront · API
  • IAM: OIDC roles
  • Budgets: Cost alerts
  • CloudTrail: Audit log
  • github: GitHub, GitHub Actions
  • infrastructure as code: Pulumi, Terraform
  • aws account: The site, IAM, Budgets, CloudTrail, Email alerts

Context

Recruiters usually receive a PDF. I wanted a link that shows my CV in five seconds and also shows technical reviewers how I build and run infrastructure.

Problem

The site had to be fast on any phone, readable in English and Portuguese, cheap to run (about the price of the domain) and secure by default. The repository also had to hold up to a code review.

Approach

The AWS account is set up by a separate, public Terraform repository. It creates GitHub OIDC roles with least-privilege policies and a permissions boundary, a monthly budget with alerts and a multi-region CloudTrail trail. It is tested with both Terraform and OpenTofu, and every apply waits for my approval.

The site itself is a Pulumi stack: a private S3 bucket behind CloudFront with HTTPS and security headers, and a serverless contact form (API Gateway, Lambda and SES) protected by Cloudflare Turnstile and rate limits.

The CV lives as versioned YAML and Markdown in both languages. The build fails if a translation is missing, and the same files generate the downloadable PDFs. Every pull request runs unit and end-to-end tests, accessibility checks, Lighthouse budgets and a link check before anything ships.

Outcome

A site that costs almost nothing to run, deploys itself from a merged pull request, and doubles as a working example of how I approach infrastructure, security and automation.