The product runs on a box. The box sits behind a Cloudflare Tunnel and is, in the honest way all self-hosted things are, sometimes not up. That is fine for app.ironops.us. That is where customers log in, and if it hiccups they know it is a login. It is not fine for the front door. The one page that has to be alive when a stranger types your name into a browser is the marketing site, and it is the one page that has no business sharing a fate with your application server.
So the first decision, before any copy or design, was a boundary. The brand site is a static build that depends on nothing of mine staying up. Astro and Tailwind compile it down to HTML and CSS, and Cloudflare serves it from the edge. ironops.us does not call back to the box, does not proxy to it, does not check if it is healthy. The product could be entirely offline and the front door still opens, the story still reads, and the one thing that matters, someone raising their hand, still works. Coupling the marketing site to the product is one of those conveniences that costs you nothing right up until the afternoon it costs you the only lead that week.
The pages are the boring, necessary set. A home page with a hero and a founder section. A protocols page. A security page. A compare page. An ROI calculator. And the trio nobody remembers until it is missing. A real 404, a privacy page, and a sitemap. I self-hosted the fonts instead of pulling them from a third party, wired up share cards so a pasted link looks like something, and added a light analytics beacon. None of that is clever. All of it is the difference between a site that looks finished and one that looks like a weekend.
The part I want to remember is the lead form, because that is where "static site" stops being simple. A form needs somewhere to send the submission. The tempting answer is to wire it straight to a CRM, which means the day the key is wrong, or the webhook moved, or it is not set up yet, every request quietly disappears and the visitor still sees a cheerful "thanks." The whole point of the site is that one form. Losing a submission is the only failure I could not accept.
So the form posts to a small API route that runs on the Cloudflare Worker, and it is layered so a lead survives zero configuration. If a webhook URL is set, it posts the lead there. If not, and an email key is set, it emails it. If neither is set, it logs it where I can still see it in the function logs, and the visitor gets a normal success message either way, with a plain mailto link sitting underneath as the floor. There is no configuration where someone raises their hand and it goes nowhere. That was the requirement, and the layering is how you meet it without pretending you will never fat-finger an environment variable.
What I would check, standing up a front door again: if my product were down right now, would this page still open, still make its case, and still capture interest? If any of those three needs the box, the boundary is in the wrong place. And for the form, walk every failure branch out loud. Unset key. Wrong key. Dead webhook. Provider outage. If any branch ends in "the lead is gone and the visitor does not know," add another layer under it until it does not.
The surprise, coming from mostly building the actual system, was how much of a good marketing site is plumbing, not persuasion. The copy took an afternoon of iteration. De-jargoning the protocols page, brightening the hero, killing a vignette that was quietly masking real content. The parts that took real care were invisible. The fate-decoupling. The fallback under the form. The 404 that is not a dead end. The site's job is to be trustworthy at the exact moment someone decides whether you are real, and trustworthy is mostly the boring layer they never see.
Notes for next time: decouple the front door from the product's uptime on purpose. Static build, edge-served, no callbacks to your own box. Build the unloved pages, 404, privacy, sitemap, because their absence is what reads as amateur. And treat the one conversion action as sacred. Layer its backend so a submission survives any single misconfiguration, and give the visitor an honest success and a fallback no matter which layer caught it. The front door should be the most reliable thing you own, precisely because it is the first thing that has to work.