bestof2

bestof2 🏆

"Frontend on Cloudflare Pages (100% Free CDN). Backend on AWS Lambda Web Functions. One single command."

The zero-lockin, dual-cloud deployment engine for modern JavaScript full-stack frameworks, decoupled monorepos, and Node.js backends. Single unified domain. Zero adapters. Zero DevOps. 100% Framework Agnostic.

⚡ GitHub Actions (Primary CI/CD Workflow)

BestOf2 is designed strictly to be zero-touch in your GitHub Actions pipeline. Add .github/workflows/deploy.yml:

name: Deploy with BestOf2
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Deploy to Cloudflare Pages + AWS
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          BESTOF2_SECRET: ${{ secrets.BESTOF2_SECRET }}  # Pulled for secure token rotation
          # Optional AWS credentials (if deploying to AWS Lambda Web Functions):
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: "us-east-1"
        run: npx bestof2 deploy

• If AWS is configured: Backend auto-deploys to AWS Lambda Web Functions.
• If AWS is NOT configured: Backend builds as container image for GHCR, frontend deploys to Cloudflare Pages, and BESTOF2_SECRET is pulled from GitHub Secrets so you can run on any VPS with -e BESTOF2_SECRET="$BESTOF2_SECRET".

🚀 Supported Frameworks & Architectures (98% of the Web)

bestof2 automatically detects your project architecture at build time with zero configuration:

🛡️ Raw Lambda URL Shielding & Security

When AWS Lambda Web Functions are deployed, AWS assigns an endpoint URL. BestOf2 completely shields this URL from public exposure:

1. Single Public URL: End users and browsers ONLY ever see https://yourdomain.com (or your-app.pages.dev). The raw Lambda URL is never exposed.
2. Secret Header Handshake (x-bestof2-secret):
   • At deploy time, BestOf2 injects a cryptographic secret token into Cloudflare Pages environment variables (BESTOF2_SECRET).
   • On every proxied request, Cloudflare's _worker.js injects x-bestof2-secret: <token>.
   • Any direct hit to the raw Lambda endpoint bypasses Cloudflare and returns 403 Forbidden.
3. Zero CORS Issues for Monorepos: Because frontend/ and backend/ live under the exact same domain, cookies, authentication headers, and fetch calls work with zero cross-origin configuration.

📄 Links & License

• GitHub Repository: https://github.com/arcopscloud/bestof2
• License: MIT © ArcOps Cloud Contributors