Energia Natural
Dynamic institutional site for a training and energy services company. Came with heavy requirements: full back-office, passwordless login, custom analytics, GDPR by design — all at zero cost.
The challenge
- Client needed to manage messages, events, projects, services, settings, users and history — all via admin.
- 16 service pages had to be generated from the database, not static.
- Login had to be passwordless (the team can't manage credentials).
- Analytics had to exist but cookieless — GDPR by design, not by consent.
- Operational budget: zero. Everything had to live on free tiers.
The approach
Astro 5 in hybrid SSR over Cloudflare Pages + D1 + R2. Magic links with single-use tokens and a D1 allowlist — no passwords, no friction. Custom analytics in ~150 lines writing straight to D1, no cookies, no third-party tool. Entire stack lives on Cloudflare and Resend free tiers.
What I built
Full back-office
8 modules: messages, events, projects, services, settings, users, analytics, history.
Dynamic pages
16 service pages SSR-generated from D1.
Passwordless auth
Magic links via Resend, single-use tokens, D1 allowlist.
Cookieless analytics
~150 lines, GDPR by design, custom dashboard.
Domain email
@energianatural.pt via Cloudflare Email Routing, free tier.
Anti-spam
Turnstile + honeypot + per-email rate-limit on the form.
What I learned
Cloudflare D1 is enough for 90% of sites
I started nervous about distributed SQLite — didn't need to be. For institutional sites with up to a few thousand users, D1 is more than enough, free, and Cloudflare Pages integration is trivial.
Custom CMS took longer than expected
I underestimated the effort of an 8-module back-office. Next time I either charge more or use Payload CMS for generic modules and only write custom code for the client-specific bits.
Lighthouse 100/100/100/100 is overkill but sells
Hitting 100 in every category cost ~2 extra days. For end users, 90+ was enough. But a perfect Lighthouse screenshot is a direct sales argument for the next client.
Magic links beat passwords
Client never asked for a "forgot password" because there's no password to forget. For small teams (up to ~20 users), I always recommend it.
What's next
Next phase: integrate payments for training enrolments and extend notifications to SMS on top of email. Waiting for real-usage feedback before pushing forward.
Need a tailored platform?
I can design and build a complete stack for your business — back-office included.