Web App · 2025 - 2026
Portfolio
This site, its API, its admin and the infrastructure that runs them.
Everything shown on this site is edited from a private admin: profile, experience, education, skills, languages, tech catalogue, projects with covers and galleries, and the messages sent from the contact form. The API feeds the home page in a single call, the site regenerates its pages every minute (ISR) and falls back to seed content when it is built without an API. Each repository ships through GitHub Actions: SonarQube, tests with coverage, gitleaks, a Lighthouse run for the site, an SBOM with a Grype scan uploaded to Dependency-Track. A version tag builds the image, pushes it to ECR and commits the new tag to the GitOps repository, where Argo CD deploys it on k3s. Secrets come from Vault through External Secrets, the AWS side (ECR, the media bucket, IAM) is Terraform. The admin keeps an audit log of every change and sign-in, e-mails new messages and sign-ins through Resend, optimizes uploaded images and purges archived messages after six months.
Gallery
Key features
- Home page served from a single API call, with ISR and a seed fallback.
- Admin for all content: profile, experience, skills, projects, media, messages.
- Media library on S3.
- Contact form with rate limiting, honeypot and optional Turnstile captcha.
- Audit log of every write and sign-in, e-mail notifications through Resend.
- CI with SonarQube, gitleaks, Lighthouse, SBOM and Grype on every commit.
- Tag-based releases to ECR, deployed by Argo CD on a self-hosted k3s cluster.
- AWS resources and IAM managed with Terraform, secrets from Vault.