Skip to content

Clara · The Public Site

A marketing site that costs nothing to run

Forms, bot protection, lead routing, an interactive property map, and NFC business cards. No server, no database, and no monthly bill. The dynamic surface is four edge functions, and that is on purpose.

  • Next.js static export
  • Cloudflare Pages
  • 4 Pages Functions
  • $0 / month

The idea

Make the dynamic surface small on purpose

This is the public site for the construction company: the homes we built, the services, the contact forms. It is not a hard technical problem, and that is exactly why it is worth being disciplined about. Sites like this accumulate a server, then a database, then a CMS, then a monthly bill and a patching obligation, for content that changes twice a year.

So the whole site compiles to static files. Next.js with output: 'export', deployed to Cloudflare Pages, served from the edge for free. Listings come from a JSON file in the repo. Nothing is rendered on demand because nothing needs to be.

But a marketing site does need to do a few things: accept a contact form, take a property inquiry, take a renovation lead, and hand back a contact card when someone taps an NFC business card. Those are the only things that cannot be a static file, so those are the only things that are not.

functions/api/contact.ts            // contact form
functions/api/property-inquiry.ts   // inquiry on a listing
functions/api/renovation.ts         // renovation lead
functions/api/tap.ts                // NFC tap, returns the employee
functions/api/tap/vcard.ts          // NFC tap, returns a vCard
typescript · The entire server-side surface area of the site

Five Cloudflare Pages Functions. They run at the edge, they hold no persistent state, and there is nothing else to attack, patch, or pay for.

Security

The secrets never reach the browser

The forms are protected by Turnstile, and a submission gets routed to Slack. Both of those involve a secret: the Turnstile secret key and the Slack webhook URL.

This is the exact place where a hastily built app leaks. The pressure is to call the webhook from the client, because it is one fetch and it works immediately in development. And then the webhook URL is in the bundle, and anyone who opens devtools can post to the company Slack forever, and nobody notices for a year.

The longer version of this argument, and the other places AI-assisted code tends to put secrets where users can read them, is over here.