How a band website became a small platform

I rebuilt the Virya website because the old one no longer matched what the band was becoming. The original requirement was modest: a fast multilingual place for music, videos, concerts and press material.

Then I added merch.

Then VIRYA AREA.

Then Signal, referrals, concert interest, reminders, weighted draws, admission passes and QR check-ins.

More than a website#

At some point it was still clearly a metal band's website, but it had also become the frontend for several working systems. I like that combination. The engineering is there to support the experience, and the home page shouldn't look like a banking dashboard.

Static first, islands where needed#

The public pages are still static-first in Astro. Text, lyrics, press material and most of the landing page ship as HTML. Small Preact islands appear only where something has to move: merch, live events, Signal, AREA and staff tools. Images have explicit dimensions, third-party embeds don't block the first render, and the site still scores 100 in the Lighthouse audits I track.

Merch and payments#

Merch introduced the first trusted server state. The browser can build a basket, but server routes validate products and prices before creating a Stripe checkout. The webhook confirms payment; the success redirect is not proof. This mattered later for one-time AREA rewards, which are reserved at checkout and consumed only after payment is confirmed.

AREA and Signal#

AREA brought geolocation and untrusted client input. The phone reports where it thinks it is, and the server checks freshness, accuracy, distance, capacity and duplicate claims. Signal moved fan registration, consent, double opt-in, referrals, city demand, draws and tickets into CrowdRelay, a separate Rust backend with PostgreSQL and background workers.

Staff and admin access#

The website never exposes CrowdRelay staff or admin keys. Privileged operations go through server routes and signed sessions. Concert QR tools have a separate staff boundary, because creating a campaign, scanning a code and redeeming a pass are different permissions, even when they happen in the same venue.

Handling failures#

I also wanted failures to stay contained. Public pages still render when CrowdRelay or Bandsintown is slow. External calls have timeouts and cached fallbacks. A registration request doesn't wait for an email provider.

Synesthesia on its own deployment#

Synesthesia pushed that boundary one step further. It's a Godot Web experience with its own rendering loop, audio, video and asset budget, so it lives on a separate deployment and visitors to the normal Virya site don't pay for a WebAssembly game they didn't ask for. The website can lead into the experience, and the experience can lead back into Signal, but they don't share a critical rendering path.

Still a band website#

So yes, it's still a band website. It just happens to include commerce, a field game, fan accounts, event workflows, an interactive album experience and a Rust backend behind the curtains.

Visitors should feel the music and the idea. I can enjoy the architecture quietly in the background. :)