Want to host the data on aws? You need a documented data processor agreement with them. Same thing with cloudflare and any other service you might want to use.
Want to use google analytics or some other javascript? Those cookies aren't required so you need a way to let users opt-in to using those cookies. And opt-out and delete any third party cookies. I'm still not clear on how the regulations expect you to delete third party cookies.
Amazon affiliate links also aren't necessary to use the service, and that sets cookies. Have to get consent before users can click on those links.
Don't forget that ip addresses are considered personal data.
And all of this might have to be written down and documented per Article 30 as well. The organization is smaller than 250 people, so that might be an out, but people are using the site daily so one could argue the processing is not occasional.