9 ms·

Show HN: Self-hosted CMS on serverless Cloudflare

265 points by wenbin 4y ago

spaniard89277 4y ago
I just use PicoCMS and upload my markdown files through FTP. I don't think there's anything out there that can compete with the simplicity of this solution, not even static site generators. It uses templates with Twig, and it's very simple PHP so you can host it anywhere. I once hit the frontpage of a big aggregator from my country and it handled like it was nothing from a very cheap shared hosting. From my Linux Mint laptop, all it takes is to open my FTP on Thunar (which involves a click in my sidebar), and I'm navigating it like any other file system. Right click, create file, write & format my post, and save the file. Viola, it's published. Oh, and you can mix Markdown with HTML and JS in your posts. Less stuff you need to learn.
- synergy20 4y ago
  is picocms still a static site? cms like drupal,wordpress can control content access with password,which is where cms stands out.
  - spaniard89277 4y ago
    Almost. It's PHP serving markdown files through twig templates, but there is no control panel or backoffice to speak of. So you basically remove 99% of the attack surface.
- gernb 4y ago
  There are different definitions of simple. I found wordpress simple because I could access the UI to post from any device. I could upload images, save drafts, and preview posts. My static site, basically requires a desktop/laptop PC and to preview I have to build the site. This is far less simple to use even if it's simpler to run
- prox 4y ago
  What is good solution for hosting a domain anonymously? I want to start blogging but don’t want to do a personal one just yet. I mean anonymous in lightweight general sense, not political activist super security.
  - Dma54rhs 4y ago
    WhoisGuard and similar are in this case enough for privacy.
  - voytec 4y ago
    WHOIS[1] masking hides your information from the world. It's a service provided by some domain sellers who, obviously, will know those details (given them by you), as well as your financial information as you can't usually lease domains using untraceable transactions. [1] https://en.wikipedia.org/wiki/WHOIS https://en.wikipedia.org/wiki/WHOIS
    - prox 4y ago
      Thank you going to look into that!
      - pwdisswordfish9 4y ago
        nearlyfreespeech.net
- stefanvdw1 4y ago
  I would argue that using something like Nuxt/Content[0]is even simpler. I create a new markdown file in my website’s local repo, write the content and commit if it’s ready for publishing. No need for the FTP step and version control is build in. This setup is also completely free since the content lives on GitHub and my static site on render.com (but any static site hosting will work). And since it’s Nuxt based, it automatically also supports more advanced features such as tagging, advanced queries and filtering. Can only recommend it! 0. https://content.nuxtjs.org https://content.nuxtjs.org
  - indigodaddy 4y ago
    Looks like free tier for render.com static sites is 100G egress per month. While this is sufficient for a low traffic site, I’d probably want to protect myself by putting Cloudflare (or some other free CDN) in front (yes I realize that render.com has their own CDN network in front, but that’s still wrapped inside the 100G free tier limit it looks like).
- revskill 4y ago
  The hardest part to me, is install PHP.
  - indigodaddy 4y ago
    There are tons of very cheap hosting providers who are stable and have been around a long time. You could look at buyshared.net which is the webhosting arm of buyvm.net.
- deleted 4y ago
  [deleted]
leetrout 4y ago
This looks fantastic. I just started a podcast and was planning to test publishing with cloudflare since it seems much cheaper than the alternatives (and planning to backup to storj). I will try this out this week!
colesantiago 4y ago
It seems there is a growing movement of headless CMSs, but I am afraid of vendor lock-in with Cloudflare and the like. Are there any other CMS's that people are using these days? Perhaps looking forward to be using in 2023?
- Existenceblinks 4y ago
  Any new name in town? My perception is that 2022 is pretty much web2 stagnation due to a lot of things.
- chedabob 4y ago
  Forestry has been on my radar for a long time but never had a need to use it https://forestry.io/ https://forestry.io/ The big draw for me is it's just Hugo/Gatsby/Jekyll underneath, and the output files can be delivered anywhere that will host static files (CloudFlare pages does this really well, as does Netlify).
  - jobsdone 4y ago
    Forestry is shutting down and pushing people to Tina instead. I guess it is the same company? I don't really know.
    - mynameisvlad 4y ago
      Considering the infobox on the Forestry site directs users to Tina with: > Our team is working on a V2 product. See it at Tina.io (in beta). I'm going to go ahead and say it's the same people.
  - Dma54rhs 4y ago
    Forestry is a dead product. Netlifly CMS seems dead as well, only the CMS part though.
- programmarchy 4y ago
  Directus (https://directus.io https://directus.io)
JonathanBeuys 4y ago
Why mix the type of software (A CMS for certain use cases) with the distribution mechanism (Cloudflare Pages etc)? Shouldn't that be two seperate issues?
- deleted 4y ago
  [deleted]
- ldoughty 4y ago
  My guess would be: Traditional CMS you do the setup and plumbing in the server because you have full control Static website hosting you prebuild a website and push it up all complied and done but in a standard supported format, do it easily can go to different providers. There's not much in between, because you can't (easily) write code that is happy to run in two different systems controlled by other people with different plumbing under the hood... It's certainly doable, but the more you generalize the more complicated your code gets... and the less you can benefit from the vendor specific stuff (e.g. removing features that one side does not support ... Or adding code to use it if it's there -- which makes code even more complicated)... Edit: and to the point of code complexity: if you did this all yourself in an alpha release, you likely would make a company/product like forestry (mentioned elsewhere in this discussion) because you've made something some people would consider somewhat or very valuable
jacooper 4y ago
How is it self hosted and hosted cloudflare at the same time ?
- manigandham 4y ago
  You host it on your own Cloudflare account.
  - ocdtrekkie 4y ago
    Are you self-hosting your pictures when you upload photos to your Google Photos account?
    - ldoughty 4y ago
      Is this GitHub repo were looking at self hosted because it's his accounts repo? I think you can ask 3 people this question and get 5 answers to where the "self hosting" line is drawn... I am not sure were I would draw this line myself :-)
    - webmobdev 4y ago
      Self-hosting means the ability to host and run the code on your own server (home or webhost). Since Microfeed is built on the cloud services offered by Clouflare, you technically can't run it independently on your own server as you will still have to use the Clouflare services: microfeed uses Cloudflare Pages to host and run the code, R2 to host and serve media files, D1 to store metadata, and Zero Trust to provide logins to the admin dashboard. @jacooper is correct that the term has been wrongly used by the creator.
    - manigandham 4y ago
      No. Self-hosting refers to running a service where you completely own the source code. You can run this on a computer in your room, or a rented VPS, or a serverless hosting option like Cloudflare Pages. For example, if you run a Nextcloud instance and upload pictures there, then you are self-hosting your photos.
  - 4y ago
ocdtrekkie 4y ago
"Self-hosted on Cloudflare" feels like an oxymoron. I know it's common for people to consider hosting on VPS and the like to be self-hosting, but attached to proprietary services seems to be a step further, I think something being portable between providers has to be a minimum for the term. I like the idea of having web content you can put up with minimal configuration and cost but we have to draw a line for that definition somewhere.
- deleted 4y ago
  [deleted]
F117-DK 4y ago
Seems very nice! Looking forward to have something like Supabase or Pocketbase deployed directly on Cloudflare! fingers crossed
- ruslan_talpa 4y ago
  Such a thing exists https://github.com/subzerocloud/showcase/tree/main/cloudflare-pages-D1 https://github.com/subzerocloud/showcase/tree/main/cloudflar...
atmosx 4y ago
I use middleman[^1] + bulmaCSS + FontAwesome but host on github using the `github.io` domain and upload podcasts to "archive.org"[^2]. I choose this setup to make sure content will survive as much as possible. ps. You might want to consider a donation to the internet archive, see [^2] - no affiliation, just a happy user. [^1]: https://middlemanapp.com/ https://middlemanapp.com/ [^2]: https://archive.org/ https://archive.org/
- deleted 4y ago
  [deleted]
Yair-Dovrat 4y ago
Super cool. Thanks for sharing, going to set this up over the weekend!
worldmerge 4y ago
Very cool! I like how there is a nice visual editor. I hate using markdown for blogging.
dangoor 4y ago
Given that this uses multiple Cloudflare services, is anyone very familiar with their pricing? The readme lists a "generous free tier", but I always have to wonder what happens once you fall outside of that tier. I remember that R2 is cheap (one of its distinguishing features), but wonder if any of the other services suddenly become $50 a month or something.
- 015a 4y ago
  Cloudflare's free tiers are hard-free; they stop working if you exceed the free tier usage (at least for compute; storage is different). Pages is essentially totally free. R2 is within the same pricing magnitude as S3. D1 is a very new product and afaik is still in beta and doesn't have production pricing yet; so be weary there. Zero Trust is less usage and more per-user, I think $7/mo/user.
  - dangoor 4y ago
    Thanks! That's very helpful and sounds unlikely to get out of control (short of hosting a wildly popular video)
    - psytrx 4y ago
      They definitely have sensible backout mechanisms for their free tiers (i.e. Pages, they still serve static assets but disable compute/Functions). Also, their docs are written pretty well, and openly hint at dangerous price traps. We launched a big presale this year with an e-commerce app hosted on Workers, and we just barely hit the 5$ threshold for the paid plan. Did not use more services (other than DNS/proxy) though, so YMMV.
    - drexlspivey 4y ago
      R2 has free egress meaning you don’t pay for bandwidth when serving your popular video
      - dangoor 4y ago
        Wow.
orliesaurus 4y ago
I use bearblog.dev, super minimalistic, markdown first, customizable...not self hosted but.. nice overall!
- deleted 4y ago
  [deleted]
nonrandomstring 4y ago
Please don't use this unless you wish to exclude those who would like to enjoy your content but also respect their privacy. Cloudflare continue to block Tor traffic by default. It is discriminatory against innocent users and harmful to freedom of speech (because speech also requires the ability to listen).
- deleted 4y ago
  [deleted]
- mikeiz404 4y ago
  Are they blocking you outright or are you required to do captchas? From a 2016 post CloudFlare states they don’t block Tor traffic and don’t let their customers block the traffic either but they will put restrictions such as captchas in place [1]. 1: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
  - nonrandomstring 4y ago
    Sometime last year I discussed this in more detail. I use a text only browser with Tor. Most websites (still > 80% maybe) load well, but the overwhelming majority of those that do not are served via Cloudflare. To me, their 2016 post claiming not to "block Tor traffic" is disingenuous, since they are exceedingly hostile to it. I only ever experience Cloudflare as an obstacle and nuisance online. I also deeply dislike their attitude and PR stand, which is essentially victim blaming and disrespectful of those who make different technological choices. Their message seems to be; "We make an effort to sound sorry to those who are harmed by our business model. But you are a minority, and we make a lot of money. If you want to make an omelet, you gotta break some eggs. Now get out of the road."
    - shadowgovt 4y ago
      The protection Cloudflare provides is antithetical to privacy because they are in the business of detecting malicious users. To do so, they need to distinguish users (including and especially users taking active measures to fuzz their identity, since there is heavy correlation between such use and malice... i.e. there are a lot more people fuzzing their identity because they want to do something bad than there are fuzzing their identity because they're simply privacy-conscious). This is a subset of a larger push-pull on the privacy needs of users vs. the integrity needs of service providers; the modern threat model is a lot more complicated than it was in the era where you could deal with an attack by black-holing an IP range. For example, Google's login flow requires (required? this may have changed) JavaScript because there are attacks possible in non-JS HTML that Google cannot protect against without using JS to do DOM inspection. Does enabling JS also allow for various privacy risks? Yes. But it increases user security.
clarkrinker 4y ago
Nice setup! I've been following Vercel and Cloudflare trying to sync up their v8 isolates runtime: CF is going to be a great option for running these "Edge Style" React apps once stuff stabilizes.
kennywinker 4y ago
This isn't directly related to the post, but it's a CMS related question: does anybody know of a simple "static file" CMS that also lets you deploy server side javascript functions? It's a weird use case, so I suspect there may not be. I've solved it by using a static site generator and a nginx reverse proxy to a node server - but it's a lot of complexity for my use case (using stripe to sell stuff, but stripe checkout requires server side session creation). Edit: Netlify Edge functions seems to be pretty much exactly what I'm describing (drop js/ts files in a directory, deploy with your static site). The only problem with it for me is it's not self-hosted. Serveless functions would work, tho the separate deployment adds a layer of complexity, and I'd have to learn CORS finally lol
- surfpel 4y ago
  Not exactly what you asked for, but if you use S3 + CloudFront, you can use javascript functions in CloudFront that can modify the request to/from the client & to/from the S3 bucket. Does things like URL redirects, header manipulation, auth... I use it to redirect ~/path/to/item/ to ~/path/to/item/index.html for my static site. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope...
- IanCal 4y ago
  Netlify? Edge functions and functions may be what you're after https://www.netlify.com/products/#netlify-edge-functions https://www.netlify.com/products/#netlify-edge-functions
  - kennywinker 4y ago
    Oh very cool! Yeah, Netlify Edge functions are pretty much exactly what I'm after... except I was hoping for something self-hosted.
    - IanCal 4y ago
      Maybe don't focus so much on the static site part, and have a very slightly dynamic site where the majority of your content is just paths that lead to stuff in /static. So rather than trying to bolt a dynamic bit to static hosting, making the simplest site with something like server.js
throwaway81523 4y ago
"Self hosted" and "serverless Cloudflare" each have their attractions, but they are contradicting terms, unless I'm confused.
- lloydatkinson 4y ago
  Running it on cloudflare by provisioning it yourself instead of using something dedicated like wordpress or contentful.
  - 0b01 4y ago
    This still makes no sense at all. Self hosting means running a program on your own machine instead of on a cloud platform such as cloudfalre.
    - geek_at 4y ago
      There is an ongoing debate in the selfhosting subreddits if it's self hosted if it's not on your hardware. Seems yes for rented servers like hetzner but gets more heated when it's about "serverless"
    - lloydatkinson 4y ago
      So what do you want to call it then? "Running on a lower level general compute abstraction with provided networking infrastructure" instead of self-hosted?
  - hunter2_ 4y ago
    WordPress is a confusing example because they have self hosted (.org) and fully managed (.com) versions. I think "not SaaS" sums up today's definition of "self hosted" although I could be mistaken.
- deleted 4y ago
  [deleted]

265 points by wenbin 4y ago

I just use PicoCMS and upload my markdown files through FTP. I don't think there's anything out there that can compete with the simplicity of this solution, not even static site generators. It uses templates with Twig, and it's very simple PHP so you can host it anywhere. I once hit the frontpage of a big aggregator from my country and it handled like it was nothing from a very cheap shared hosting. From my Linux Mint laptop, all it takes is to open my FTP on Thunar (which involves a click in my sidebar), and I'm navigating it like any other file system. Right click, create file, write & format my post, and save the file. Viola, it's published. Oh, and you can mix Markdown with HTML and JS in your posts. Less stuff you need to learn.

synergy20 4y ago
is picocms still a static site? cms like drupal,wordpress can control content access with password,which is where cms stands out.
- spaniard89277 4y ago
  Almost. It's PHP serving markdown files through twig templates, but there is no control panel or backoffice to speak of. So you basically remove 99% of the attack surface.
gernb 4y ago
There are different definitions of simple. I found wordpress simple because I could access the UI to post from any device. I could upload images, save drafts, and preview posts. My static site, basically requires a desktop/laptop PC and to preview I have to build the site. This is far less simple to use even if it's simpler to run
prox 4y ago
What is good solution for hosting a domain anonymously? I want to start blogging but don’t want to do a personal one just yet. I mean anonymous in lightweight general sense, not political activist super security.
- Dma54rhs 4y ago
  WhoisGuard and similar are in this case enough for privacy.
- voytec 4y ago
  WHOIS[1] masking hides your information from the world. It's a service provided by some domain sellers who, obviously, will know those details (given them by you), as well as your financial information as you can't usually lease domains using untraceable transactions. [1] https://en.wikipedia.org/wiki/WHOIS https://en.wikipedia.org/wiki/WHOIS
  - prox 4y ago
    Thank you going to look into that!
    - pwdisswordfish9 4y ago
      nearlyfreespeech.net
stefanvdw1 4y ago
I would argue that using something like Nuxt/Content[0]is even simpler. I create a new markdown file in my website’s local repo, write the content and commit if it’s ready for publishing. No need for the FTP step and version control is build in. This setup is also completely free since the content lives on GitHub and my static site on render.com (but any static site hosting will work). And since it’s Nuxt based, it automatically also supports more advanced features such as tagging, advanced queries and filtering. Can only recommend it! 0. https://content.nuxtjs.org https://content.nuxtjs.org
- indigodaddy 4y ago
  Looks like free tier for render.com static sites is 100G egress per month. While this is sufficient for a low traffic site, I’d probably want to protect myself by putting Cloudflare (or some other free CDN) in front (yes I realize that render.com has their own CDN network in front, but that’s still wrapped inside the 100G free tier limit it looks like).
revskill 4y ago
The hardest part to me, is install PHP.
- indigodaddy 4y ago
  There are tons of very cheap hosting providers who are stable and have been around a long time. You could look at buyshared.net which is the webhosting arm of buyvm.net.
deleted 4y ago
[deleted]

leetrout 4y ago

This looks fantastic. I just started a podcast and was planning to test publishing with cloudflare since it seems much cheaper than the alternatives (and planning to backup to storj). I will try this out this week!

colesantiago 4y ago

It seems there is a growing movement of headless CMSs, but I am afraid of vendor lock-in with Cloudflare and the like. Are there any other CMS's that people are using these days? Perhaps looking forward to be using in 2023?

Existenceblinks 4y ago
Any new name in town? My perception is that 2022 is pretty much web2 stagnation due to a lot of things.
chedabob 4y ago
Forestry has been on my radar for a long time but never had a need to use it https://forestry.io/ https://forestry.io/ The big draw for me is it's just Hugo/Gatsby/Jekyll underneath, and the output files can be delivered anywhere that will host static files (CloudFlare pages does this really well, as does Netlify).
- jobsdone 4y ago
  Forestry is shutting down and pushing people to Tina instead. I guess it is the same company? I don't really know.
  - mynameisvlad 4y ago
    Considering the infobox on the Forestry site directs users to Tina with: > Our team is working on a V2 product. See it at Tina.io (in beta). I'm going to go ahead and say it's the same people.
- Dma54rhs 4y ago
  Forestry is a dead product. Netlifly CMS seems dead as well, only the CMS part though.
programmarchy 4y ago
Directus (https://directus.io https://directus.io)

JonathanBeuys 4y ago

Why mix the type of software (A CMS for certain use cases) with the distribution mechanism (Cloudflare Pages etc)? Shouldn't that be two seperate issues?

deleted 4y ago
[deleted]
ldoughty 4y ago
My guess would be: Traditional CMS you do the setup and plumbing in the server because you have full control Static website hosting you prebuild a website and push it up all complied and done but in a standard supported format, do it easily can go to different providers. There's not much in between, because you can't (easily) write code that is happy to run in two different systems controlled by other people with different plumbing under the hood... It's certainly doable, but the more you generalize the more complicated your code gets... and the less you can benefit from the vendor specific stuff (e.g. removing features that one side does not support ... Or adding code to use it if it's there -- which makes code even more complicated)... Edit: and to the point of code complexity: if you did this all yourself in an alpha release, you likely would make a company/product like forestry (mentioned elsewhere in this discussion) because you've made something some people would consider somewhat or very valuable

jacooper 4y ago

How is it self hosted and hosted cloudflare at the same time ?

manigandham 4y ago
You host it on your own Cloudflare account.
- ocdtrekkie 4y ago
  Are you self-hosting your pictures when you upload photos to your Google Photos account?
  - ldoughty 4y ago
    Is this GitHub repo were looking at self hosted because it's his accounts repo? I think you can ask 3 people this question and get 5 answers to where the "self hosting" line is drawn... I am not sure were I would draw this line myself :-)
  - webmobdev 4y ago
    Self-hosting means the ability to host and run the code on your own server (home or webhost). Since Microfeed is built on the cloud services offered by Clouflare, you technically can't run it independently on your own server as you will still have to use the Clouflare services: microfeed uses Cloudflare Pages to host and run the code, R2 to host and serve media files, D1 to store metadata, and Zero Trust to provide logins to the admin dashboard. @jacooper is correct that the term has been wrongly used by the creator.
  - manigandham 4y ago
    No. Self-hosting refers to running a service where you completely own the source code. You can run this on a computer in your room, or a rented VPS, or a serverless hosting option like Cloudflare Pages. For example, if you run a Nextcloud instance and upload pictures there, then you are self-hosting your photos.
- 4y ago

ocdtrekkie 4y ago

"Self-hosted on Cloudflare" feels like an oxymoron. I know it's common for people to consider hosting on VPS and the like to be self-hosting, but attached to proprietary services seems to be a step further, I think something being portable between providers has to be a minimum for the term. I like the idea of having web content you can put up with minimal configuration and cost but we have to draw a line for that definition somewhere.

deleted 4y ago
[deleted]

F117-DK 4y ago

Seems very nice! Looking forward to have something like Supabase or Pocketbase deployed directly on Cloudflare! fingers crossed

ruslan_talpa 4y ago
Such a thing exists https://github.com/subzerocloud/showcase/tree/main/cloudflare-pages-D1 https://github.com/subzerocloud/showcase/tree/main/cloudflar...

atmosx 4y ago

I use middleman[^1] + bulmaCSS + FontAwesome but host on github using the `github.io` domain and upload podcasts to "archive.org"[^2]. I choose this setup to make sure content will survive as much as possible. ps. You might want to consider a donation to the internet archive, see [^2] - no affiliation, just a happy user. [^1]: https://middlemanapp.com/ https://middlemanapp.com/ [^2]: https://archive.org/ https://archive.org/

deleted 4y ago
[deleted]

Yair-Dovrat 4y ago

Super cool. Thanks for sharing, going to set this up over the weekend!

worldmerge 4y ago

Very cool! I like how there is a nice visual editor. I hate using markdown for blogging.

dangoor 4y ago

Given that this uses multiple Cloudflare services, is anyone very familiar with their pricing? The readme lists a "generous free tier", but I always have to wonder what happens once you fall outside of that tier. I remember that R2 is cheap (one of its distinguishing features), but wonder if any of the other services suddenly become $50 a month or something.

015a 4y ago
Cloudflare's free tiers are hard-free; they stop working if you exceed the free tier usage (at least for compute; storage is different). Pages is essentially totally free. R2 is within the same pricing magnitude as S3. D1 is a very new product and afaik is still in beta and doesn't have production pricing yet; so be weary there. Zero Trust is less usage and more per-user, I think $7/mo/user.
- dangoor 4y ago
  Thanks! That's very helpful and sounds unlikely to get out of control (short of hosting a wildly popular video)
  - psytrx 4y ago
    They definitely have sensible backout mechanisms for their free tiers (i.e. Pages, they still serve static assets but disable compute/Functions). Also, their docs are written pretty well, and openly hint at dangerous price traps. We launched a big presale this year with an e-commerce app hosted on Workers, and we just barely hit the 5$ threshold for the paid plan. Did not use more services (other than DNS/proxy) though, so YMMV.
  - drexlspivey 4y ago
    R2 has free egress meaning you don’t pay for bandwidth when serving your popular video
    - dangoor 4y ago
      Wow.

orliesaurus 4y ago

I use bearblog.dev, super minimalistic, markdown first, customizable...not self hosted but.. nice overall!

deleted 4y ago
[deleted]

nonrandomstring 4y ago

Please don't use this unless you wish to exclude those who would like to enjoy your content but also respect their privacy. Cloudflare continue to block Tor traffic by default. It is discriminatory against innocent users and harmful to freedom of speech (because speech also requires the ability to listen).

deleted 4y ago
[deleted]
mikeiz404 4y ago
Are they blocking you outright or are you required to do captchas? From a 2016 post CloudFlare states they don’t block Tor traffic and don’t let their customers block the traffic either but they will put restrictions such as captchas in place [1]. 1: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
- nonrandomstring 4y ago
  Sometime last year I discussed this in more detail. I use a text only browser with Tor. Most websites (still > 80% maybe) load well, but the overwhelming majority of those that do not are served via Cloudflare. To me, their 2016 post claiming not to "block Tor traffic" is disingenuous, since they are exceedingly hostile to it. I only ever experience Cloudflare as an obstacle and nuisance online. I also deeply dislike their attitude and PR stand, which is essentially victim blaming and disrespectful of those who make different technological choices. Their message seems to be; "We make an effort to sound sorry to those who are harmed by our business model. But you are a minority, and we make a lot of money. If you want to make an omelet, you gotta break some eggs. Now get out of the road."
  - shadowgovt 4y ago
    The protection Cloudflare provides is antithetical to privacy because they are in the business of detecting malicious users. To do so, they need to distinguish users (including and especially users taking active measures to fuzz their identity, since there is heavy correlation between such use and malice... i.e. there are a lot more people fuzzing their identity because they want to do something bad than there are fuzzing their identity because they're simply privacy-conscious). This is a subset of a larger push-pull on the privacy needs of users vs. the integrity needs of service providers; the modern threat model is a lot more complicated than it was in the era where you could deal with an attack by black-holing an IP range. For example, Google's login flow requires (required? this may have changed) JavaScript because there are attacks possible in non-JS HTML that Google cannot protect against without using JS to do DOM inspection. Does enabling JS also allow for various privacy risks? Yes. But it increases user security.

clarkrinker 4y ago

Nice setup! I've been following Vercel and Cloudflare trying to sync up their v8 isolates runtime: CF is going to be a great option for running these "Edge Style" React apps once stuff stabilizes.

kennywinker 4y ago

This isn't directly related to the post, but it's a CMS related question: does anybody know of a simple "static file" CMS that also lets you deploy server side javascript functions? It's a weird use case, so I suspect there may not be. I've solved it by using a static site generator and a nginx reverse proxy to a node server - but it's a lot of complexity for my use case (using stripe to sell stuff, but stripe checkout requires server side session creation). Edit: Netlify Edge functions seems to be pretty much exactly what I'm describing (drop js/ts files in a directory, deploy with your static site). The only problem with it for me is it's not self-hosted. Serveless functions would work, tho the separate deployment adds a layer of complexity, and I'd have to learn CORS finally lol

surfpel 4y ago
Not exactly what you asked for, but if you use S3 + CloudFront, you can use javascript functions in CloudFront that can modify the request to/from the client & to/from the S3 bucket. Does things like URL redirects, header manipulation, auth... I use it to redirect ~/path/to/item/ to ~/path/to/item/index.html for my static site. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope...
IanCal 4y ago
Netlify? Edge functions and functions may be what you're after https://www.netlify.com/products/#netlify-edge-functions https://www.netlify.com/products/#netlify-edge-functions
- kennywinker 4y ago
  Oh very cool! Yeah, Netlify Edge functions are pretty much exactly what I'm after... except I was hoping for something self-hosted.
  - IanCal 4y ago
    Maybe don't focus so much on the static site part, and have a very slightly dynamic site where the majority of your content is just paths that lead to stuff in /static. So rather than trying to bolt a dynamic bit to static hosting, making the simplest site with something like server.js

throwaway81523 4y ago

"Self hosted" and "serverless Cloudflare" each have their attractions, but they are contradicting terms, unless I'm confused.

lloydatkinson 4y ago
Running it on cloudflare by provisioning it yourself instead of using something dedicated like wordpress or contentful.
- 0b01 4y ago
  This still makes no sense at all. Self hosting means running a program on your own machine instead of on a cloud platform such as cloudfalre.
  - geek_at 4y ago
    There is an ongoing debate in the selfhosting subreddits if it's self hosted if it's not on your hardware. Seems yes for rented servers like hetzner but gets more heated when it's about "serverless"
  - lloydatkinson 4y ago
    So what do you want to call it then? "Running on a lower level general compute abstraction with provided networking infrastructure" instead of self-hosted?
- hunter2_ 4y ago
  WordPress is a confusing example because they have self hosted (.org) and fully managed (.com) versions. I think "not SaaS" sums up today's definition of "self hosted" although I could be mistaken.
deleted 4y ago
[deleted]