Technical case study

Portfolio Architecture

robinhuang.nz is a multilingual Astro portfolio designed as both a human-readable CV and a machine-readable public profile. The site favours static generation, explicit project status labels, public-only JSON, and documented security boundaries.

Public Site Boundary

The static Astro site publishes portfolio pages, localized routes, blog content, and read-only JSON endpoints. It does not expose private messages, admin records, analytics, secrets, or repository files.

  • Astro static generation
  • English source-of-truth content
  • Localized routes for EN, zh-CN, zh-HK, and KO
  • Root JSON and versioned API routes

Machine-Readable Portfolio

The public JSON surface is generated from the same source data as the pages, so project status, certification status, and prototype caveats stay aligned.

  • /profile.json
  • /cv.json
  • /projects.json
  • /certificates.json
  • /.well-known/portfolio.json
  • /public/search-index.json

Assistant Safety Model

The portfolio assistant is constrained to public site content and source links. Requests are validated, limited, and refused when they ask for private messages, secrets, prompts, tokens, or admin data.

  • Public source index only
  • Input length and markup checks
  • CORS allowlist support
  • Timeout fallback to grounded local answer

Security Headers

The site keeps a documented CSP, HSTS, referrer policy, content-type protection, frame restrictions, and permissions policy. Inline script is limited to static JSON-LD and theme bootstrap needs.

  • default-src self
  • frame-ancestors none at the edge
  • strict-origin-when-cross-origin referrers
  • Permissions-Policy denies sensors and payment APIs

Performance Budget

The site avoids client-heavy rendering for core pages. Images, CSS, static JSON, and page routes are checked through the production build before publishing.

  • Static HTML first
  • No public write routes
  • Short-cache JSON with revalidation
  • Build-time API and security tests

Deployment Flow

  1. 1

    Source Data

    Portfolio, CV, projects, certificates, and localized copy live in typed local source files.

  2. 2

    Astro Build

    The build emits localized HTML, static JSON endpoints, sitemap output, OpenAPI, and JSON-LD metadata.

  3. 3

    Static Hosting

    GitHub Actions publishes the static output to S3 and CloudFront with response headers controlled at the edge.

  4. 4

    External APIs

    Contact and assistant APIs are isolated serverless services with their own validation, CORS, rate limits, and private storage boundaries.

Robin Huang · IT Systems & Application Support | Software Testing & Automation