Static files in an S3 bucket, served through CloudFront with a certificate from ACM, fronted by Route 53 for DNS. The bucket is private; CloudFront reaches it through an Origin Access Control. There is no server in the conventional sense, which is part of the appeal — nothing to patch at three in the morning.