Tech stack
A static site, hand-written front end and free services, chosen so the club pays nothing beyond the domain and no visitor is tracked.
Principles
- Zero recurring cost
Every service is on a free tier and none is priced per user. The club pays for the domain and nothing else.
- Privacy first
No cookies, no consent banner, no player logins. Maps, video, social posts and translation load only when asked.
- No frameworks
Hand-written HTML, CSS custom properties and plain JavaScript. Every page works with JavaScript switched off.
- Editable by volunteers
All content is YAML and Markdown, edited in a browser through Pages CMS and versioned in Git.
The stack, layer by layer
-
1Content
- YAML and Markdown One file per player, team, roster, event, rink, gallery and post; relationships resolved at build time.
- Pages CMS Browser editor that commits straight to GitHub. Free, no seats.
-
2Build
- Eleventy 3 Static site generator with Nunjucks templates.
- eleventy-img AVIF, WebP and JPEG at three widths, lazy-loaded with fixed dimensions.
- resvg-js Renders per-page Open Graph images and player trading cards from SVG in the club's typeface.
- Pagefind Static search index built after every build; searches run in the browser.
-
3Delivery
- Cloudflare Pages Deploys from the main branch on every commit, with security headers, redirects from the old site and a global cache.
- Pages Functions One small function relays the contact form after a spam check so keys never reach the browser.
- Cloudflare Access Email one-time codes for the coaches area; a short allowlist, no player accounts.
-
4In the browser
- Leaflet + OpenStreetMap Self-hosted map library; tiles load after a one-time click.
- Photo viewer Native dialog with zoom, pan, swipe, pinch, keyboard and full screen. No library.
- instant.page Preloads same-site pages on hover or touch.
- Bunny Fonts Barlow Condensed for headings, served from the EU without logging; body text uses the system font.
- Lucide and Simple Icons Inline SVG sprite containing only the icons used.
-
5Services
- Web3Forms + Turnstile Form delivery to the club inbox with a cookie-free spam check and a honeypot.
- Buttondown Newsletter with RSS-to-email from the site's Atom feed; tracking off.
- Umami Aggregate page counts, no cookies, no IP addresses.
- GTranslate Machine translation, loaded only when the language button is pressed.
- Spond Attendance and team chat, outside the website. Schedule feeds import into the season planner.
Quality gates on every build
A build that fails any gate is not published. Each gate was made to fail on purpose before it was trusted.
- 1CMS configThe editor configuration parses and every content field is declared.
- 2BuildAll pages, feeds, images and the search index.
- 3CalendarsEvery feed parsed by an independent iCalendar library and checked line by line.
- 4SEOUnique titles and descriptions, canonical, Open Graph, structured data and alt text on every page.
- 5Accessibilityaxe-core on every page in both themes at phone width, plus overflow and tap-target checks.
- 6LighthousePerformance, accessibility, best practices and SEO at 95 or better on key pages.
Security and privacy headers
Every response carries a strict Content Security Policy, HSTS, frame denial, a referrer policy and a permissions policy. What each service handles is set out in the privacy policy; the standards the site targets are in the accessibility statement; the components and tokens are in the style guide.