I rebuilt the Virya website because the old one no longer matched what the band was becoming. The original requirement was modest: a fast multilingual place for music, videos, concerts and press material.
Then I added merch.
Then VIRYA AREA.
Then Signal, referrals, concert interest, reminders, weighted draws, admission passes and QR check-ins.
It stopped being just a website
At some point it was still clearly a metal band's website, but it had also become the frontend for several real systems. I like that combination. The engineering is there to support the experience, not to make the home page look like a banking dashboard.
Static first, islands where needed
The public pages remain static-first in Astro. Text, lyrics, press material and most of the landing page ship as HTML. Small Preact islands appear only where something genuinely has to move: merch, live events, Signal, AREA and staff tools. Images have explicit dimensions, third-party embeds do not block the first render and the site still scores 100 in the Lighthouse audits I track.
The browser does not set the price
Merch introduced the first trusted server state. The browser may build a basket, but server routes validate products and prices before creating a Stripe checkout. The webhook confirms payment; the success redirect is not proof. That distinction later became important for one-time AREA rewards, which are reserved at checkout and consumed only after payment is confirmed.
The client reports. The server decides.
AREA brought geolocation and untrusted client input. The phone reports where it thinks it is, while the server checks freshness, accuracy, distance, capacity and duplicate claims. Signal moved fan registration, consent, double opt-in, referrals, city demand, draws and tickets into CrowdRelay — a separate Rust backend with PostgreSQL and background workers.
Staff is not admin
The website never exposes CrowdRelay staff or admin keys. Privileged operations pass through server routes and signed sessions. Concert QR tools have a separate staff boundary, because creating a campaign, scanning a code and redeeming a pass are different permissions even when they happen in the same venue.
Failures stay in their lane
I also wanted failures to stay in their lane. Public pages continue to render when CrowdRelay or Bandsintown is slow. External calls have timeouts and cached fallbacks. A registration request does not wait for an email provider.
Still a band website
So yes, it is still a band website. It just happens to include commerce, a field game, fan accounts, event workflows and a Rust backend behind the curtains.
The visitors should feel the music and the idea. I can enjoy the architecture quietly in the background. :)