Site Infrastructure

How this site
is hosted.

ReneeBuilds.com is a static site hosted on Google Cloud Platform — a direct byproduct of the Multicloud Identity Governance & Entitlement Engine project. The hosting pipeline demonstrates the same security principles the portfolio documents.

Stack

Hosting
GCP Cloud Storage — static website bucket, publicly readable by design
DNS & TLS
Cloudflare — CNAME to c.storage.googleapis.com, DNS-only. TLS terminated at Cloudflare edge in Full mode; Cloudflare→GCS backend hop encrypted via GCS's own certificate. Genuinely end-to-end — no unencrypted hop.
Security Headers
Cloudflare response-header transform rule applying HSTS, CSP, and X-Content-Type-Options to every request — confirmed live on both apex and www.
Deploy Pipeline
GitHub Actions — push to main triggers deploy. No secrets stored anywhere in the pipeline.
Authentication
Workload Identity Federation, scoped to this repo's main branch specifically. A token minted anywhere else is rejected before it reaches GCP.
Infrastructure as Code
Terraform — GCP resources, Cloudflare DNS, and security header rules. Labeled and cost-tracked. State stored in AWS S3 remote backend.

Two honest CSP interactions

Running a strict Content Security Policy alongside Cloudflare's own features surfaces two real, expected interactions worth naming rather than hiding.

Web Analytics beacon blocked by tracking protection

Cloudflare auto-injects a Web Analytics script on every page. Browsers with tracking protection enabled correctly recognize static.cloudflareinsights.com as an analytics domain and block it — a zero-byte response, not a broken script. This is documented, expected behavior for every site running Cloudflare Web Analytics, not a misconfiguration here.

Bot-management script blocked by CSP

Cloudflare also injects a small inline script for bot detection. Its content embeds a fresh, per-request token on every load, so it can never be allowlisted with a static CSP hash — the Transform Rule that sets these headers doesn't have per-request nonce generation available without a Cloudflare Worker. CSP correctly blocks it every time. Site functionality for real visitors is unaffected — this only means that specific bot-fingerprinting probe never runs on requests governed by this policy.

A deliberate exception

The hosting bucket is intentionally publicly readable — that's what makes static website hosting work. Every other guardrail (versioning, least-privilege deploy service account, branch-scoped WIF) is layered around that one necessary exception rather than pretending it isn't there.

Source

Infrastructure-as-code lives in the Multicloud Identity Governance repo. Site content lives in the GitHub Pages repo.

Infrastructure (MIG) → Site Content →