Infrastructure on Alexander's Bloghttps://alexanderbakin.com/categories/infrastructure/Recent content in Infrastructure on Alexander's BlogHugoen-usThu, 20 Aug 2026 12:02:45 +0400Building a Production-Grade Personal Blog with AWS, Terraform, and Hugohttps://alexanderbakin.com/meta/Fri, 14 Aug 2026 00:00:00 +0000https://alexanderbakin.com/meta/<h2 id="motivation">Motivation</h2> <p>As a DevOps engineer, your personal website is your portfolio. It should demonstrate not just what you <em>know</em> but what you <em>build</em>. This blog is itself an example of a production-grade cloud architecture - every decision documented, every tradeoff explained.</p> <h2 id="architecture-overview">Architecture Overview</h2> <p><img alt="Architecture diagram: Route53 to CloudFront to S3, with GitHub Actions driving Terraform and content deploys via OIDC" loading="lazy" src="https://alexanderbakin.com/images/architecture-diagram.svg"></p> <p>The stack:</p> <table> <thead> <tr> <th>Layer</th> <th>Technology</th> </tr> </thead> <tbody> <tr> <td><strong>Content</strong></td> <td>Markdown → Hugo static site</td> </tr> <tr> <td><strong>CI/CD (Infra)</strong></td> <td>GitHub Actions - PR plan, merge apply</td> </tr> <tr> <td><strong>CI/CD (Content)</strong></td> <td>GitHub Actions - build, sync, invalidate</td> </tr> <tr> <td><strong>State Mgmt</strong></td> <td>S3 backend, concurrency-gated at pipeline level</td> </tr> <tr> <td><strong>Origin</strong></td> <td>S3 (private, versioned, encrypted, CloudFront OAC only)</td> </tr> <tr> <td><strong>CDN</strong></td> <td>CloudFront with HTTPS, Brotli/Gzip, security headers</td> </tr> <tr> <td><strong>DNS</strong></td> <td>Route 53 alias records (A / AAAA, root + www)</td> </tr> <tr> <td><strong>TLS</strong></td> <td>ACM certificate (auto-renewal, TLSv1.2_2021)</td> </tr> <tr> <td><strong>Auth</strong></td> <td>OIDC - no AWS access keys stored anywhere</td> </tr> <tr> <td><strong>Monitoring</strong></td> <td>CloudWatch dashboard + error rate alarm</td> </tr> <tr> <td><strong>Cost Control</strong></td> <td>AWS Budgets alert (direct email)</td> </tr> </tbody> </table> <h2 id="key-design-decisions">Key Design Decisions</h2> <h3 id="1-two-separate-pipelines">1. Two Separate Pipelines</h3> <p>Infrastructure changes and content changes have different risk profiles and review requirements. They&rsquo;re handled by separate workflows:</p>