brenda-nails.com / infrastructure

A nail studio,
run without servers.

A small business site where nothing is always on. The pages are static files behind a CDN, the owner edits her own content, and a single function handles both the content and the bookings — which is why the whole thing costs a few pounds a month instead of a few hundred.

Region eu-west-2 London Origin private S3 + OAC Provisioned with Terraform Site checking… API checking…
Client

A customer

Opens brenda-nails.com, usually on a phone

step 1
Edge · 400+ locations worldwide

Route 53

Resolves the apex and www to the nearest edge

Both names on one distribution — no redirect hop

step 2

ACM certificate

TLS terminates at the edge

Issued in us-east-1, DNS-validated, renews itself

step 3

CloudFront Function

Rewrites /treatments to /treatments/index.html before the cache is consulted

Runs on viewer-request, sub-millisecond, no cold start

step 4

CloudFront

Serves the page from the edge closest to the customer

Most requests stop here and never reach London

Origin · eu-west-2 London

S3

The built Astro site — reached only on a cache miss

Public access blocked — only CloudFront can read it, via OAC

on cache miss
Measured from your browser, just now
ms round trip

Fetching a file from brenda-nails.com to time the real path…

Decisions worth defending

Rewrite at the edge, not the origin
A CloudFront Function turns /treatments into /treatments/index.html during the viewer request. It runs before the cache lookup, costs a fraction of Lambda@Edge, and keeps the bucket a plain file store.
One function, two jobs
Content and bookings share a single Lambda. At this traffic level a second function would add deployment surface and cold starts without buying isolation that matters.
The CMS key never ships
The browser calls the API, and the API calls Webiny. Credentials stay server-side, so the owner can edit content without exposing anything to visitors.
Permissions named one by one
The function may send email and publish to one topic ARN. It cannot read the bucket, touch DNS, or publish anywhere else.