Hostnames with no ambiguity
Production is the repository name. Preview hosts follow one written rule — apex zones get preview.zone, label sites get a dashed www-preview. Deploy fails closed if a run claims a name that is not its own.
Managed static hosting
Merge the branch. We take it from there.
Every site is one repository named after the hostname people type. You push HTML; we fingerprint the assets, keep the entry pages revalidating, invalidate the edge, and refuse to call the deploy finished until each durable public body has the same checksum as what you shipped.
The contract, in numbers
1 repoper production hostname, named for it
2 secretsthe whole setup on your side
30 daysbrowser cache on fingerprinted assets
0 keysstorage keys handed to authors
Not a mock-up
This repository is a tenant on the platform it describes
Its deployment path is the one shown below: GitHub in our organization, a workload identity whose blob modifications are limited to one project prefix, a slice of Azure Blob static website storage, and Azure Front Door in front of it. No storage key exists on the publishing side. A deploy is complete only when the public durable bodies match their staged checksums and dropped durable paths return 404.
What you get, and why it is built that way
A folder that is only yours
Visitor files and non-routed workflow state live in sibling folders inside one project prefix. Attribute conditions keep the upload identity's modifications inside that prefix.
Fingerprints, handled for you
Stylesheets, scripts, and images are renamed with a content hash and the deploy date, and your HTML is rewritten to match. New bytes mean a new URL, so long browser caching is safe instead of risky.
Invalidation as a service
The shared edge cannot restrict a purge to one hostname through access control alone. So tenants call our job instead of holding that permission: it proves the caller and requested FQDN against platform-owned Front Door routes, while a durable pre-mutation queue preserves unfinished paths. Current 200 bodies must match their staged SHA-1; dropped durable paths must return 404 before that queue clears.
Certificates you never renew
Managed certificates on every custom domain, a current TLS policy across the whole site, and a second TLS hop to origin. Nothing about certificates is reachable from your workflow.
Redirects in front of origin
Point www at the apex — or one path at another — with temporary redirects evaluated before origin. For example, serve 307 from www.xyz.tld to xyz.tld and from www-preview.xyz.tld to preview.xyz.tld; it is a redirect, not a reverse proxy.
Storage lifecycle designed to fail safe
Our next lifecycle job will control storage growth inside each public/ tree after reading state/version.txt directly from storage. It never touches durable state/to-purge-* queues. Anything dated to the current deploy is protected, and scheduled deletion remains disarmed until operators explicitly enable it.
Site-specific image compression
This site compresses each image for its actual display widths, measures perceptual quality against byte size, and puts its effective source identity in every derivative name. When a reviewed crop exists, that identity combines the untouched original’s SHA-1 with explicit crop coordinates. Unchanged source, crop, and output digests skip the optimizer; a changed input replaces and retires its old local derivative family. It is local to this site, not a hosting feature.
Pick the page that matches your week
You publish pages
Two secrets, one branch, and a check that goes green. No cache headers to choose, no cloud console to learn.
Authors →You run the pipeline
Upload order, checksum-and-404 verification as the gate, pinned library versions, and exactly which permissions a tenant identity must never hold.
Operations →You own the catalog
What we take on, what we refuse, how multi-tenancy is priced in effort, and where another team’s DNS operator fits.
Owners →“Week two. They said put files in
— Priya N., intern, content. One of our hypothetical reviews.publicand merge. I still do not know what a Front Door is. The check goes green and my page is the one on the hostname.”
Want the engineering, not the brochure?
Every mechanism above has a blog post: hostname rules, project prefixes, fingerprinting, the two cache audiences, durable removal of pages and folders, why edge purge is a steward job, the two workload identities, source-addressed image optimization, DNS we are not allowed to write, and the planned storage-lifecycle deletion window. Each post says what is live and what comes next.