Rendered before you ask for it
The pages are written in React and TypeScript and rendered to plain HTML when the site is built. Every page reads fine with JavaScript switched off; the JavaScript only adds the theme switch and the copy buttons.
how it’s built
The engineering, shown.
The best evidence of how we work is what we have built. Here is the architecture behind this site and behind Pwyll — the same patterns we use for clients.
01this site
A handful of static files, served properly.
Most small-business sites are a WordPress install on a shared host: a database, dozens of plugins, and a login page anyone can find. This one has none of those.
you
Browser
brooks-labs.com, via Route 53
edge
CloudFront
TLS certificate from ACM; security headers on every response
at the edge
CloudFront Function
www → bare domain; /pwyll → /pwyll/index.html
origin
S3 bucket
Private; readable only by CloudFront (OAC)
A private bucket behind a CDN
The files sit in an S3 bucket that nobody can read directly. Only CloudFront can, through origin access control, and it serves them from edge locations around the world.
A little code at the edge
A CloudFront Function runs on every request before the cache: it sends www to the bare domain and turns clean addresses like /pwyll into the page that answers them.
Strict about what loads
Every response carries a content security policy that allows scripts, styles, fonts and images from this domain only — so no analytics, no trackers, no third-party fonts — along with HSTS and a refusal to be framed.
All of it is code
Two CDK stacks describe everything: the certificate (in us-east-1, where CloudFront needs it) and the site itself. One command builds the pages, uploads them and clears the cache. DNS is Route 53, and the certificate renews itself.
Costs almost nothing
No server runs when nobody is visiting. Hosting a site like this costs a few dollars a month at most, and there is nothing to patch.
curl -sI https://brooks-labs.com | grep -i -e content-security -e strict-transport content-security-policy: default-src 'self'; … frame-ancestors 'none' strict-transport-security: max-age=63072000; includeSubDomains
02pwyll
A serverless chat backend.
Pwyll is an AI assistant with memory and group chats. Behind the app, all of its code runs on Lambda: functions start when someone is talking and stop when they are done, and there is no server to patch.
clients
iPhone & Apple Watch
Sign-in with Cognito
apis
REST API
API Gateway → FastAPI on Lambda
WebSocket API
Streams each reply as it is written
work
SQS → worker Lambda
Generates replies, runs tools
Models
Claude on Amazon Bedrock, and others
EventBridge
Scheduled memory reviews
data
Aurora PostgreSQL
IAM sign-in, least-privilege role
OpenSearch
Search filtered per person and group
S3 + KMS
Files and pictures, encrypted
Two front doors
A REST API for everything, and a WebSocket API that streams replies as the model writes them. Both require a Cognito sign-in: the REST API checks it before any code runs, the socket as it connects.
Slow work off the request path
A message sent through the REST API is stored and its reply queued: a worker takes it from SQS, calls the model and stores the answer, so no request ever waits on a model. Over the WebSocket, the reply streams back as it is written.
Identity comes from the sign-in
Who is asking, and who is in a group, is taken from the verified token and passed to every tool by the server. The model never chooses whose data it acts on.
Privacy enforced in the query
Every search is filtered by the server to what the people present may see. In a group, a document comes back only if everyone in the chat belonged to the group it came from.
No passwords to leak
The functions sign in to PostgreSQL with short-lived IAM tokens, as a database role that can touch only the tables it needs. Files are encrypted with a key in KMS.
Memory, in the background
A scheduled job looks for conversations that have gone quiet and has a model update the user’s profile from them, citing where each fact came from.
Prompt caching that holds
The system prompt never changes between replies — the time travels with each message instead — so long conversations reuse the model’s cache and cost a fraction of their size.
Untrusted text is treated as such
Web pages and search results can try to instruct a model. Pwyll never loads images from outside its own storage, closing the easiest way to smuggle data out through a reply.
Fast starts
Lambda SnapStart restores each function from a snapshot taken after start-up, so a cold start doesn’t mean waiting for Python to import its libraries.
03principles
How we’d build yours.
Your project won’t look like Pwyll, but it will be built the same way.
In your account
Your AWS Organization, your repository, your bill. We work with access you can revoke.
Infrastructure as code
Every resource is described in code, reviewed like code, and can be rebuilt from it.
Least privilege
Each piece can do exactly its job. Nothing shares a password, and most things have none.
Managed over maintained
Managed services instead of servers to patch, wherever they do the job.
Quiet when idle
Serverless where it fits, so a small business pays for what it uses rather than for machines waiting.
Readable when it breaks
Logs, alarms and audit trails you can follow, so problems are found by us before your customers.
Want this for your business? Get in touch.