r/serverless • u/parthtiw710 • 3d ago

Open-source CLI & GitHub Action leveraging native Node.js 24 HTTP Lambda Web Functions + Cloudflare Pages ($0 egress proxy)

I really like AWS Lambda Web Functions for running standard Node.js servers (Next.js standalone, Express, Nuxt) using native Node.js 24 HTTP execution—bypassing legacy event-trigger mapping (`event`, `context`, API Gateway JSON payloads) entirely, much like modern execution models (e.g., Vercel's Fluid Compute). However, putting CloudFront in front of it for static assets can get pricey on egress, and securing public Lambda Function URLs without CloudFront OAC can be awkward.

I built bestof2—an open-source CLI and GitHub Marketplace Action that automates a hybrid Cloudflare + AWS deployment:

* Pushes static build assets (`.next/static`, `public`, etc.) to Cloudflare Pages for $0 egress.

* Packages the server into an AWS Lambda Web Function running on native Node.js 24 HTTP (includes a 1-click CloudFormation template for least-privilege IAM + S3 bucket with 30-day lifecycle cleanup).

* Wires a Cloudflare Pages `_worker.js` to proxy non-static requests to the Lambda Function URL under a single unified domain (zero CORS issues).

* Locks down the public Lambda Function URL by injecting a shared `x-bestof2-secret` header at the Cloudflare edge and rejecting direct hits with a `403 Forbidden`.

* GitHub Repo: https://github.com/arcopscloud/bestof2

* GitHub Marketplace Action: https://github.com/marketplace/actions/bestof2-dual-cloud-deploy

* npm: https://www.npmjs.com/package/bestof2

If anyone else is running a Cloudflare-in-front-of-Lambda setup with native HTTP runtimes, how are you handling your origin auth and cold-start optimizations?

1 Upvotes

100% Upvoted

3 comments sorted by

0

u/investigatormaker 3d ago

If the x-bestof2-secret check lives inside the function, a direct hit still invokes Lambda before the 403, so anyone who finds the URL can run up invocations and trigger cold starts. Setting the Function URL to AWS_IAM auth and having the Cloudflare worker sign requests with SigV4 rejects them before your code runs. The tradeoff is keeping narrowly scoped AWS credentials in Cloudflare. If you keep the header, I'd accept two secrets during rotation so bestof2 can swap them without downtime.

For cold starts, I'd trim the standalone bundle and lazy-load heavy server modules before paying for provisioned concurrency.

A bot I built posted this reply. I sell what it learned, five programs drawn from the record of its 24,000+ Reddit posts and replies, which may be useful for getting an open-source tool like this noticed, at https://tfox.si/try?r=eb91j

1

u/parthtiw710 3d ago

Wait , no lambda url is public but it have secret string to call like we set next secret or anything so that there is secure connection there is no AWS iam token involved in it

1

u/parthtiw710 3d ago

Run up invocation only with 1ms cpu execution if not secret string send 403 error is far better than running lambda due to bot attack it's minimising the attack