Work
ClientClient · NGO
Sonqo Perú

Sonqo Perú

I migrated a Peruvian NGO’s site from WordPress to Astro. Infrastructure and operating cost at zero, with one-time and monthly donations in production.

View live site

Screenshot of Sonqo Perú
SYSTEM.md

The problem

The site lived on WordPress, with infrastructure and operating costs. They had to drop to zero without losing the ability to receive donations or to edit content.

What I built

I rebuilt the site in Astro with a serverless backend and connected one-time and monthly donations to Mercado Pago (Checkout API and Bricks). Content is edited in Sanity.

Outcome

In production, processing real payments, with infrastructure and operating cost at zero.

Decisions that mattered

  1. 01

    A payment is real when the provider confirms it

    Webhooks are verified with an HMAC signature and the payment status is fetched from the Mercado Pago API, never trusted from the browser.

  2. 02

    One validation

    The same Zod schemas validate on the client and on the server, and Upstash Redis rate-limits requests per visitor.

  3. 03

    Content without developers

    Sanity lets the team edit figures, images and copy without touching the payment flows.

  4. 04

    Deployed on Google Cloud

    Cloud Build builds the image, Artifact Registry stores it and Cloud Run serves it; secrets live in Secret Manager.

Technologies

  • Astro
  • TypeScript
  • Mercado Pago
  • Sanity
  • Supabase
  • Resend
  • Upstash Redis
  • Cloud Run

C4 model. The pulsing line is the main path of a request.

Level 1 · who uses the system and what it connects to

HTTPS1Checkout API · Bricks2HTTPSGROQStudioDonorGives once or monthlySonqo teamEdits the contentSonqo siteDonations and contentMercado Pago[Mercado Pago]Charges and reports theresultResend[Resend]Transactional emailSanity[Sanity]Editable content

Level 2 · the applications and data stores it is made of

HTTPS1GROQ · buildPOST ·JSON2deploy · secretsPayments · HMACwebhook3rate limitSQLHTTPSSanity[Sanity]Editable contentGoogle Cloud[Cloud Build · Artifact Registry ·Secret Manager]Builds, ships and keepssecretsDonorGives once or monthlySite[Astro 7 · Bun]Pages and componentsServer routes[Rutas SSR · Cloud Run]Validate and create thechargeMercado Pago[Mercado Pago]Charges and reports theresultUpstash Redis[Upstash Redis]Request rate limitingSupabase[Supabase · PostgreSQL]PostgreSQL databaseResend[Resend]Transactional email

Level 3 · the components inside the API

pipelinepipelinevalidinput1Checkout API2rate limitwebhook3idempotencyconfirmationHoneypot[honeypot]Drops bots without tellingthemRate limit[Upstash ratelimit]Per visitor, with RedisValidation[Zod]Shared Zod schemasCharge[Mercado Pago SDK]Checkout API and BricksUpstash Redis[Upstash Redis]Request rate limitingMercado Pago[Mercado Pago]Charges and reports theresultWebhook[HMAC · idempotency]HMAC signature and realstatusResend[Resend]Transactional email
  • Person
  • System
  • Container
  • Database
  • External
  • Main path
  1. 01Donor
  2. 02Astro
  3. 03Mercado Pago
  4. 04Verified webhook
  5. 05Resend

CV

Get my CV

Leave your email and I will send the CV there. First I check the address is yours with a code.