Colophon

Stack

Framework	Astro 5 — static site generator + content collections (markdown/MDX)
Runtime	Cloudflare Workers — single worker (khavan) serves HTML + API + cron
Static delivery	Workers Assets binding — không có Pages, không có outer CDN
Search	Pagefind (keyword) + Vectorize (semantic) — toggle ở /search/
Embeddings	bge-m3 qua Workers AI — 1024-dim multilingual
RAG / "Ask the blog"	Vectorize top-5 → Bedrock Claude Opus 4.7 qua OIDC federation

Storage

D1 khavan-subscribers	subscribers + digests + contacts + post views + AI cache + webmentions + intel hub
KV OIDC_CREDS_CACHE	Bedrock temp creds (45-phút TTL) tránh STS exchange mỗi call
R2 khavan-backups	D1 snapshot hàng tuần (NDJSON.gz, 84-day retention)
Vectorize khavan-posts	1,500+ vector chunks indexed từ post archive

AI integrations

• Workers AI bge-m3 — embed query cho semantic search + RAG (free tier)
• Workers AI Llama 3.1 — fallback nếu Bedrock fail
• AWS Bedrock Claude Opus 4.7 — primary cho RAG + post summarize
• OIDC federation — Worker mints JWT, AWS STS exchange → temp creds. Không có long-lived AWS key trong code. Chi tiết bài này.
• AI Gateway — cache Bedrock calls 24h, observability
• Daily budget cap 500 calls/UTC ngày, kill switch nếu lạm dụng

Cron schedule

• 0 */6 * * * — Intel Hub ingest RSS + LLM analyze (mỗi 6h)
• 0 2 * * SUN — Weekly digest + outgoing webmentions (Sun 02:00 UTC)
• 0 3 * * SUN — D1 snapshot → R2 (Sun 03:00 UTC)
• 0 9 * * * — GitHub Actions daily rebuild cho drip-publish (Daily 09:00 UTC)

Security

• HSTS preload + DNSSEC active + DMARC p=reject
• Cloudflare WAF 5 custom rules (Free plan max), Bot Fight Mode bypass verified bots
• Rate limit 5 req/10s edge + per-IP sliding window ở app layer
• Cloudflare Access JWT gate /admin/* + email allowlist
• Worker Observability 100% sampling — query qua Analytics Engine SQL API
• OIDC keys rotated qua wrangler secret, không trong git

Design

• Tokens: chủ đạo orange #f48120 (Cloudflare brand reference) + ink/muted hierarchy
• Font: Inter variable, self-hosted woff2 (latin + vietnamese subsets, preloaded per locale)
• Theme: light/dark + system, theme-color meta cho mobile browser chrome
• OG image per-post: SVG template render qua resvg WASM → PNG 1200×630

Open source acknowledgments

Dependencies trực tiếp trong package.json:

• astro · @astrojs/mdx · @astrojs/rss · @astrojs/sitemap
• @cf-wasm/resvg — SVG → PNG cho OG images
• aws4fetch — SigV4 sign cho Bedrock invoke từ Worker
• wrangler · pagefind
• vitest + @cloudflare/vitest-pool-workers cho test suite

Inspiration design: blog.cloudflare.com. Color contrast tuned cho WCAG AA.

Hosting cost

Free tier hoàn toàn (Cloudflare Workers Free Plan):

• Workers: 100k req/day free → tại sao site này dùng < 5% quota
• D1: 5 GB storage + 5M reads/day → 0.7 MB sử dụng, 1000 reads/day
• KV: 100k reads/day → vài chục reads/day cho OIDC cache
• R2: 10 GB storage + 1M Class A ops/month → vài hundred ops/tháng
• Vectorize: 5M queried dims/month → khoảng 100k/tháng
• Workers AI: free tier limited neurons/day → đủ

Bedrock (AWS): pay-per-token, daily budget 500 calls cap. Realistic spend < $5/tháng.

Source

Source code công khai ở github.com/vanhoangkha/khavan. CI: GitHub Actions → wrangler deploy. Mỗi push → ~3 phút từ commit đến live.

License

• Content: All Rights Reserved. Trích dẫn ngắn + link OK; reuse cần xin phép. Chi tiết: terms.
• Code snippets trong bài: MIT license.
• Repository code: chưa public license — đọc OK, fork OK, sử dụng commercial cần liên hệ.
• AI training: KHÔNG cho phép. Content-Signal directives trong /robots.txt.

Contact

khavan.work@gmail.com · LinkedIn · GitHub