Cost-Optimized Portfolio Hosting
The portfolio itself is an Azure architecture project: a globally delivered static site designed around Azure Static Web Apps Free so the recurring Azure hosting target stays at $0/month while the workload remains within included quotas.
Actions→OIDC + Deployment
Stack→Static Web Apps
Free
Do not pay for services the workload does not need.
The workload is HTML, CSS, JavaScript, and a resume PDF. It needs HTTPS, a custom domain, global static delivery, repeatable deployment, pull-request previews, and a recovery path—but it does not need server compute, a database, a paid Azure CDN, or a distributed tracing platform.
The architecture therefore optimizes for minimum operational and financial surface area while keeping an explicit upgrade path for future requirements rather than pre-provisioning enterprise services for résumé value.
Use less Azure on purpose.
A small Azure runtime footprint with a separate edge-routing layer.
browser
+ Worker routing
Web Apps Free
+ resume PDF
GitHub reaches Azure without a reusable client secret.
Actions
federation
short-lived token
What-If / Stack deploy
content
curated dist/
deployment token
site only
Right-sized architecture means accepting the right limitations.
The baseline targets $0/month Azure hosting while usage remains inside Static Web Apps Free quotas. Domain registration remains an external cost.
Global static delivery is built in, but the Free plan has no SLA. That is accepted for a personal portfolio and becomes an explicit redesign trigger if the site becomes business-critical.
Managed HTTPS, CSP/security headers, curated public artifacts, OIDC-based Azure authentication, and gated production delivery provide a practical baseline without adding a paid Azure WAF or private endpoint the workload does not require.
The site has no mutable application state. Git is the authoritative copy, so recovery is revert/redeploy rather than database or VM restoration.
Plain HTML/CSS/JavaScript and a two-resource Azure footprint minimize patching, runtime dependencies, and operational ownership.
The current design relies on the Static Web Apps service limits. Sustained traffic, storage, preview, SLA, or backend requirements are the signals to upgrade rather than preemptively adding Azure services.
Deployment is automated without storing a reusable Azure client secret.
GitHub Actions authenticates to Azure through workload identity federation using OIDC. Infrastructure is modeled in subscription-scoped Bicep, compiler-validated in CI, evaluated with live ARM What-If, and managed in production through an Azure Deployment Stack.
The site artifact is curated so public content is separated from IaC and internal documentation. Security headers and Content Security Policy are part of the static-site configuration. Pushes to the protected main branch deploy only after the validation gates succeed.
The baseline spends only where a requirement exists.
Azure Static Web Apps Free: expected Azure hosting charge is $0 while the site remains within the Free-plan quota.
Static Web Apps provides the Azure hosting/TLS baseline. Cloudflare provides authoritative DNS and edge routing without adding a paid Azure Front Door/CDN resource.
Cloudflare fronts the custom domain and routes requests to the Azure portfolio origin. Domain registration remains an external cost.
GitHub Actions handles automation. Any GitHub usage cost is separate from Azure hosting cost and depends on the account's GitHub quotas.
None. Static content does not justify a runtime or persistence layer, so both remain $0 by architectural omission.
None in the baseline. A static personal portfolio does not currently justify dedicated Application Insights / Log Analytics resources.
Free is a constraint, not an excuse to hide limits.
The architecture was written around the Free-plan included quotas for bandwidth, environment storage, preview environments, and related platform limits. If real usage approaches those boundaries, the correct response is a deliberate upgrade—not wishful thinking.
The Free tier does not provide an SLA. That is accepted for a personal portfolio and is explicitly not presented as an enterprise availability posture.
Private endpoints, paid support/availability, backend API requirements, or other advanced Azure controls are future triggers for Standard or a different architecture rather than baseline features.
A stateless site should have a stateless recovery model.
Git is the source of truth. Revert the content change and redeploy rather than restoring mutable application state.
Recreate the intended resource group and Static Web App from the subscription-scoped Bicep/Deployment Stack, then republish the curated static artifact.
Cloudflare is authoritative for the public hostname and Worker routing, so DNS/edge troubleshooting remains intentionally separated from the Azure hosting footprint.
The Free-tier baseline accepts the lack of an SLA. If availability becomes business-critical, that requirement itself triggers a paid architecture decision.
Cost optimization is requirement-driven architecture.
The workload is static. Paying for an App Service plan would add compute cost and operational surface without adding a current capability.
Cloudflare already satisfies the authoritative DNS and lightweight edge-routing requirements, so adding Azure DNS or Front Door solely for the portfolio would create cost/complexity without solving a new requirement.
The site has no backend transaction or dependency graph that justifies distributed tracing. Deployment history and basic resource health are sufficient for the current workload.
Bandwidth, preview capacity, SLA, private networking, backend API requirements, or business criticality are the conditions that justify a larger Azure architecture.
The site separates architecture intent from deployment proof.
Requirements, NFRs, cost/security/operations docs, ADRs, recovery guidance, diagrams, and known limitations are source-controlled.
Bicep lint/build, production parameters, JavaScript syntax, and public-site metadata checks are green.
GitHub Actions authenticates through OIDC, ARM What-If resolves the intended footprint, and the production infrastructure is managed through a subscription Deployment Stack.
The Static Web App is deployed and serving the portfolio. The Cloudflare custom-domain path, HTTPS delivery, Hickory geo route, non-local portfolio route, and private portfolio bypass have been exercised.