Waymaku
Education association in Iquitos, Peru. The organization behind Enaki
The institutional site of the education association behind Enaki: open research, free resources on intercultural education, an opinion blog and a souvenir shop, backed by its own API on the same kind of hardened infrastructure.
- Role
- Design, front end, back end and infrastructure
- Year
- 2026
- Status
- Live· waymaku.edu.pe
Where it started
Before
- Site and domain on a shared hosting plan at Punto.pe
- Nothing in front of the server: no CDN, no DDoS or bot filtering
- Static pages with no backend to store contacts or complaints
Now
- DNS and proxy on Cloudflare: CDN, DDoS mitigation, bot protection and HTTPS enforced with TLS 1.2+
- Static front end on Hostinger; API on a hardened VPS with Docker
- Old URLs redirect to the new pages, so existing links and search results keep working
- Encrypted daily backups stored off the server
Architecture
The path of a request, from the browser down to the database.
- 01
Hostinger · waymaku.edu.pe
The site the visitor loads: static files, with no application server to attack. When someone sends a form, the request heads to the VPS.
- 02
Cloudflare
DNS, CDN and proxy in front of everything. Absorbs DDoS attacks, filters bots and enforces HTTPS before a request reaches the VPS.
- 03
Caddy on the VPS
The only way into the VPS. Serves Cloudflare's IP ranges only, with a Cloudflare Origin certificate (Full strict) and security headers.
- 04
FastAPI
Contact form and online complaints book, in its own container, with migrations applied on start.
- 05
PostgreSQL
On a private Docker network: no published port and no route to the internet. Only the API can reach it.
Security
Same hardening as Enaki
Origin reachable only through Cloudflare, enforced twice by the firewall and by Caddy; SSH keys only, no root login, default-deny firewall.
Rate limiting by real IP
Per-form limits keyed on the visitor's real address from CF-Connecting-IP, so a bot can't flood the contact form or the complaints book.
Strict validation
The same rules on both sides: the forms guide the visitor, Pydantic enforces them on the server, and outgoing e-mail rejects header injection.
No CMS to secure
Articles, research and the catalog live in versioned data files. There is no admin panel, plugin or login page for anyone to break into.
What I built
Editorial sections
Research, open resources and an opinion blog, built on a shared block format so new articles are just data.
Souvenir shop with cart
A catalog with a shopping cart; orders are closed over WhatsApp, with no payment gateway to maintain for now.
Online complaints book
Required by Peruvian law: yearly correlative numbering with a row lock, and copies e-mailed to the association and the consumer.
Built for slow connections
Light pages that read well on a phone in the Amazon, with properly credited openly licensed photos.
Stack
Does your organization need a site like this?
I design, build and run websites with their own back end, security and infrastructure.
Related service: Websites & web apps
Contact me