Hono is a TypeScript web framework built directly on Web Standards (Request, Response, Fetch, Web Crypto, ReadableStream), designed for serverless and edge runtimes. In production it accepts HTTP requests, matches them against routes via one of five router implementations, runs composed middleware chains, and produces standard Responses — with optional JSX server rendering, streaming (SSE, Suspense), input validation, static site generation, and a type-safe RPC client. It ships as a library whose main entry points are `src/index.ts` (exports the `Hono` class) and `src/hono.ts` (the default SmartRouter-backed instance), plus per-runtime adapter packages for Cloudflare Workers/Pages, Deno, Bun, AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice), Node.js, Vercel, Netlify, Lambda@Edge, and Service Workers. Architecturally it is a modular monorepo: a small core (`src/hono-base.ts`, `src/context.ts`, `src/request.ts`, `src/compose.ts`), a router layer with genuinely novel implementations (RegExpRouter compiles a trie of registered routes into one optimized regex per HTTP method at runtime; SmartRouter dynamically selects the fastest router; plus TrieRouter, LinearRouter, PatternRouter), dozens of built-in middleware (CORS, CSRF, JWT/JWKS, secure-headers, ETag, cache, rate-limit-style helpers), helper modules (streaming/SSE, cookies, CSS-in-JS, WebSocket, testing), a custom JSX engine with both server-side streaming and a client-side DOM renderer, and a typed RPC client (`hc`) that derives request/response types from route schemas. The framework's signature is its deep type-level inference: handler chains, middleware variables, validation targets, and client calls are all statically checked. Code quality is exceptional. The RegExpRouter is a masterclass in performance engineering, the JWT utilities are self-contained Web Crypto implementations, and the entire codebase carries heavy test coverage (unit, conformance suites shared across routers, type-level tests, and runtime tests for every platform). It is actively maintained, continuously benchmarked against Express/Fastify-class routers, and tracks bundle size and type-check performance in CI. The main risk is complexity drift: `src/types.ts` contains dozens of generic overloads, the experimental JSX/DOM layer and SSG are marked unstable, and the in-repo runtime adapters are deprecated in favor of external `@hono/*` packages ahead of v5 — intentional migration, not neglect.
This repository implements a local MTProto proxy for Telegram Desktop, designed to bypass network censorship by wrapping Telegram's protocol in WebSocket connections, often routed through Cloudflare. It is a fully-featured desktop application with CLI and GUI modes, providing a robust solution for circumventing DPI-based blocking. The architecture is a monolithic asyncio application with a clear separation of concerns: the `proxy/` package handles the core protocol translation (MTProto to WebSocket, Fake TLS, HTTP/2 multiplexing), the `ui/` package provides a cross-platform tray interface using CustomTkinter, and `utils/` contains supporting infrastructure like update management and diagnostics. The system employs a sophisticated fallback chain (WebSocket pool -> Cloudflare Proxy -> Cloudflare Worker -> Direct TCP) to ensure reliability. The codebase demonstrates high engineering craftsmanship. It features several genuinely reusable components, including a custom `httpx` HTTP/2 transport, a robust connection pool with exponential backoff, and an atomic self-update mechanism with rollback. While tightly coupled to Telegram's specific protocol, the underlying patterns for network resource management, protocol obfuscation, and desktop application lifecycle are well-isolated and could be extracted for other projects. The extensive test suite and professional CI/CD pipeline further attest to its quality.
The DDNS repository is a Dynamic DNS client application that automatically updates DNS records when the public IP address changes. It features a plugin architecture for DNS providers, flexible configuration loading from multiple sources (CLI, JSON, environment variables), cross-platform task scheduling (cron, systemd, launchd, schtasks), an embedded web dashboard for configuration and monitoring, and MCP server integration for AI assistants. The application is designed to have minimal runtime dependencies, relying only on the Python standard library, and supports both IPv4 and IPv6 addresses.
Pingora is a production-grade Rust framework for building fast, reliable, and programmable networked systems, developed and battle-tested at Cloudflare (handling 40M+ requests/second). It provides a modular architecture with crates for HTTP/1.1 and HTTP/2 proxying, TLS termination (OpenSSL, BoringSSL, rustls, s2n-tls), load balancing (weighted round-robin, consistent hashing), caching (LRU, TinyUFO), rate limiting, and observability (Prometheus, Sentry). The core abstraction is the `ProxyHttp` trait, which allows users to define request/response filters, upstream selection, error handling, and module integration via lifecycle hooks. The framework also includes a server lifecycle manager with graceful shutdown, daemonization, and file descriptor transfer for zero-downtime upgrades. The architecture is library-oriented: users compose services by implementing traits and configuring YAML-based server settings. Key entry points include `pingora::Server` for process management, `pingora_proxy::http_proxy_service` for creating proxy services, and `pingora_load_balancing::LoadBalancer` for background health checks and discovery. Data flows involve downstream HTTP sessions (H1/H2), upstream connections via pooled connectors, and optional caching layers with eviction policies. External dependencies include tokio, http, h2, lru, ahash, and various TLS libraries. While primarily an application framework, Pingora contains research-grade components like `tinyufo` (a lock-free cache algorithm with TinyLFU admission and S3-FIFO eviction) and `pingora-ketama` (nginx-compatible consistent hashing). These are packaged as reusable crates with extensive benchmarks and memory profiling. The codebase is well-structured with clean trait-based abstractions, but the large workspace (20+ crates) and multiple TLS backends introduce maintenance complexity. Overall, it is a high-quality, actively maintained framework suitable for building custom proxies, load balancers, and edge services.
This repository is a full-stack monorepo template for building SaaS applications using React 19, tRPC, and Cloudflare Workers. It features an edge-native architecture with three Workers (web router, app SPA, and API server) connected via service bindings. The template includes integrated authentication (Better Auth with email OTP, passkey, Google OAuth), multi-tenancy, Stripe billing, transactional emails (via Resend), file uploads to Cloudflare R2, and a Neon PostgreSQL database accessed through Drizzle ORM with Hyperdrive connection pooling. Key components include a reusable shadcn/ui component library, a typed WebSocket protocol package, and isolated database testing utilities.
wgcf is an unofficial, cross-platform command-line tool for Cloudflare WARP. It reverse-engineers the official Android client's undocumented API to register WARP accounts, bind license keys, and emit ready-to-use WireGuard profiles. The codebase is organized as a Cobra-based CLI with distinct subcommands (register, update, generate, status, trace), a Viper-backed TOML config layer, a custom OpenAPI-generated API client for api.cloudflareclient.com, and a dedicated WireGuard profile generator. Its most distinctive piece is a uTLS-based HTTP transport that replicates the exact TLS ClientHello of Cloudflare's Android app, allowing the tool to pass server-side fingerprint checks. The OpenAPI specification is actively maintained and version-pinned to WARP build 5641, with generated Go client code that should be regenerated when the spec changes. This is a pure application repository; the only data-like artifacts are the OpenAPI contract and schema models, which serve the client rather than enable research or analytics.
This is a Nuxt 3 module that integrates Cloudflare Turnstile, a privacy-focused CAPTCHA alternative. It provides a Vue component (`<NuxtTurnstile>`) for client-side rendering of the Turnstile widget, a composable (`useScriptCloudflareTurnstile`) for script loading via `@nuxt/scripts`, and a server-side utility (`verifyTurnstileToken`) for token validation in Nitro endpoints. The module automatically handles script injection, token refresh, and exposes a reset method. It also supports an optional validation endpoint at `/_turnstile/validate`. The architecture follows the standard Nuxt module pattern: `src/module.ts` registers components, composables, and server handlers. External dependencies include Cloudflare's Turnstile API, `@nuxt/scripts`, `@nuxt/kit`, `defu`, and `pathe`. The codebase is well-structured, typed, and includes end-to-end tests with Playwright.
This is a Node.js automation tool that deploys and maintains Cloudflare Web Application Firewall (WAF) custom rules across all zones in a Cloudflare account. It runs as a long-lived daemon (via PM2) with scheduled cron jobs: one fetches the latest expressions from the repository (git pull) and another updates the WAF rules via the Cloudflare Rulesets API. The service parses rule expressions from a markdown file, applies user configuration (PHP/WordPress support, custom allowlist/blocklist per zone, external IP threat feeds from SniffCat and AbuseIPDB), and syncs the resulting custom rules and IP lists to Cloudflare. It includes robust error notification via email and Discord webhooks with batched alert delivery. The codebase is well-structured, thoroughly tested (Jest), and actively maintained with frequent updates.
ArgoX is a comprehensive bash-based deployment and management tool for setting up Xray proxy servers with Cloudflare Argo tunnels on VPS. It supports 12 proxy protocols (VLESS, Hysteria2, Shadowsocks, etc.) and provides interactive and non-interactive installation, automated configuration generation, firewall management, subscription output for multiple clients (Clash, V2rayN, Sing-box, etc.), and hot-reload via Xray gRPC API. The script handles complex tasks like deriving X25519 keys, managing Cloudflare tunnels via API, selecting optimal CDN proxies, and implementing Hysteria2 Realm for NAT traversal. It is actively maintained with frequent updates and extensive error handling.
This repository provides a self-hosted platform for deploying and managing web applications on a single server. It integrates Cloudflare for public access via tunnels, Tailscale for secure private access, Docker and Kamal for containerized deployment, and GitHub for webhook-triggered updates. The system consists of a daemon that handles incoming webhooks and manages deployments, and a CLI for initial setup and ongoing administration. Applications are deployed with zero-downtime using Kamal, and the platform automates the configuration of DNS, TLS, and service discovery. The architecture centers around a single Go binary that operates in two modes: as a background service (singleserverd) to process GitHub webhooks and orchestrate deployments, and as a command-line interface (singleserver) for users to configure the platform, add applications, and manage resources. State is stored in files under /etc/singleserver (configuration, credentials) and /srv (source code, storage, backups). The platform emphasizes simplicity and automation, aiming to reduce the operational overhead of running multiple applications on a single VPS. Key features include an interactive setup wizard for connecting provider accounts, automatic DNS and TLS configuration via Cloudflare, secure access through Tailscale Funnel, and a built-in diagnostics tool (doctor) to verify system health. The design prioritizes reliability through atomic file updates, context-aware command execution, and comprehensive error handling. The project includes extensive unit tests and end-to-end validation scenarios that exercise real integrations with the supported services.
This repository is a toolchain for generating Apple Configuration Profiles (.mobileconfig) that configure DNS over HTTPS (DoH) and DNS over TLS (DoT) on iOS, iPadOS, and macOS devices. It maintains a curated registry of public encrypted DNS providers (e.g., AdGuard, Cloudflare, Quad9, CleanBrowsing) with metadata such as server addresses, filtering capabilities, and region. The build pipeline reads provider definitions from JSON files under src/, generates unsigned profiles in profiles/, optionally signs them with CMS digital signatures using a user-provided ECC certificate, and places signed versions in signed/. It also produces multi-language README files (English, Simplified Chinese, Traditional Chinese) with provider tables and installation links. The architecture is a set of TypeScript scripts executed via npm commands (build, sign, new, test). There is no runtime server or daemon; the output is static files intended for manual installation by end users. The interactive CLI (npm run new) guides users through creating new provider profiles with validation and optional signing. The codebase demonstrates solid engineering practices: deterministic UUIDs (v5) for stable profile identifiers, CMS signing with both Node.js crypto and OpenSSL parity tests, and a modular design that separates provider data, language templates, and build logic. While the repository is primarily a build tool, it also serves as a reference for encrypted DNS provider capabilities and a practical solution for deploying encrypted DNS on Apple devices. The signed profiles provide authenticity verification, and the multi-language support broadens accessibility. The code is well-structured and maintainable, though it relies on external certificates for signing and manual updates to provider data when server endpoints change.
CloudflareSpeedTest is a CLI tool written in Go that measures latency and download speed of Cloudflare CDN IP addresses to find the fastest ones for users in China, where many Cloudflare IPs are suboptimal. It reads IP ranges from files (ip.txt/ipv6.txt) or command-line arguments, performs concurrent TCP or HTTP ping tests, filters results by latency/loss rate, then conducts HTTP download speed tests on the lowest-latency IPs. The final output is a sorted list of the best IPs displayed in the console and saved to a CSV file. The tool supports extensive customization: thread count, ping count, port, download test duration, speed/latency thresholds, colocation filtering via HTTP headers, and debug logging. It also includes helper scripts for automatically updating system hosts files, 3proxy configurations, or Cloudflare DNS records with the optimal IP. The architecture is a single binary with modular task files (tcping, httping, download, ip parsing) and utility modules (color output, CSV export, progress bar). External dependencies are minimal: ewma for moving average, pb for progress bars, and color for terminal colors. The codebase is well-structured with clear separation of concerns, though it lacks automated tests and CI pipelines. It is a practical, community-driven tool with over 29k stars, actively maintained with recent commits and responsive issue triage.
CloakBrowser is a commercial stealth browser automation library that wraps Playwright (Python, JavaScript, .NET) with a custom patched Chromium binary. Its core purpose is to evade bot detection by spoofing browser fingerprints, providing human-like interaction (Bezier mouse moves, realistic typing with typos, smooth scrolling), and managing licensed binary downloads with cryptographic verification. The architecture is a multi-language SDK sharing identical logic across Python, TypeScript, and C#, with a common human interaction engine, proxy/GeoIP integration, and license enforcement via denial files and server validation. Key entry points are the `launch()` and `humanize()` APIs, CLI diagnostics (`info`, `login`, `install`), and the `cloakserve` CDP multiplexer. External dependencies include Playwright/Puppeteer, MaxMind GeoLite2 database, Ed25519 signature verification (BouncyCastle), and a license validation server. The codebase demonstrates high engineering discipline with extensive cross-language parity tests and security-conscious binary distribution, but carries drift risks from triple-language duplication and reliance on Playwright internal APIs.
Cloudflare's CFSSL is a comprehensive PKI/TLS toolkit written in Go, providing both a command-line interface and an HTTP API server for certificate lifecycle management. It handles certificate signing, chain bundling, revocation (CRL/OCSP), TLS scanning, key generation, CSR creation, and CA initialization. The system is modular, with separate packages for CLI commands, API handlers, signers (local/remote), certificate database abstraction (SQLite/MySQL/PostgreSQL), a bundler with chain optimization, an OCSP responder, a TLS scanner, and a transport layer for automated mutual TLS. It uses interface-based design for pluggable backends (signers, database accessors, key providers, trust stores) and includes features like multi-root CA support, pre-issuance linting via zlint, certificate transparency embedding, ubiquity scoring for chain selection, IP whitelisting, HMAC authentication, Prometheus metrics, and post-quantum cryptography (ML-DSA). The codebase also contains custom cryptographic implementations (MD5, SHA-1, SHA-256, SHA-512) with assembly-optimized blocks for performance. While actively maintained with CI/CD and extensive tests, some components show technical drift (pinned Go 1.27, forked TLS library, legacy algorithm support).
CloudMeet is a full-stack meeting scheduler (Calendly alternative) built entirely on Cloudflare's free tier. It uses SvelteKit for the frontend and server-side logic, Cloudflare D1 for the database, KV for caching, and Workers for cron-based email reminders. The application supports single-user (admin) operation with Google Calendar and Outlook Calendar integration, allowing attendees to book meetings that automatically create calendar events with video conferencing links (Google Meet or Microsoft Teams). It includes a comprehensive email notification system via Emailit API, customizable availability rules, event types, and a dashboard for managing bookings, profiles, and email templates. The architecture is a monolith deployed to Cloudflare Pages with a separate cron worker for reminders. The codebase demonstrates solid engineering practices: TypeScript throughout, well-structured caching layer with KV and browser cache, request coalescing, input validation, and a modular email template system. It is not a data research project; it is a production-ready application.
OpenCut is a free and open-source video editor being rewritten from scratch. The repository is a monorepo containing a web application (React with TanStack Router, shadcn/ui components, Cloudflare Workers deployment), a desktop application (Rust with GPUI framework), a minimal API (Elysia on Cloudflare Workers), and a media crate for FFmpeg dependency management. Currently in early development, the web app has placeholder routes for home and editor, the desktop app opens a window with empty panels (browser, preview, inspector, timeline), and the API provides health and echo endpoints. The media crate includes a sophisticated build script that downloads or compiles FFmpeg from source for multiple platforms. The codebase demonstrates clean architecture with well-separated concerns, but most features are not yet implemented. The high star count (91k) likely reflects the previous classic version, not the current rewrite.
CF-Clearance-Scraper is a Python CLI tool designed to solve Cloudflare challenges (JavaScript, managed, and interactive) and extract the cf_clearance cookie for bypassing anti-bot protections. The application uses Zendriver for headless browser automation, dynamically generates realistic Chrome user agents, handles proxy authentication via CDP events, and provides output formats including raw cookies, cURL/Wget/aria2 commands, or JSON storage. The architecture is monolithic with a single entry point (main.py) featuring clean separation of concerns: argument parsing, browser orchestration, challenge detection/solving, and output formatting. Key strengths include robust user agent fallback mechanics and proxy handling, though the Cloudflare-solving logic is tightly coupled to Zendriver and challenge-specific heuristics.
This is a self-hosted, free image hosting service (Telegraph-Image) built as a serverless application on Cloudflare Pages. It provides image upload, storage (Telegram Bot API or Cloudflare R2), serving with optional moderation (Workers AI or moderatecontent.com), and an admin dashboard (Vue-based) for managing images (list, block, delete, whitelist, edit names, toggle likes). The architecture follows a clean provider pattern for storage and moderation modules, uses middleware chaining via Cloudflare Pages Functions, and includes features like short links (KV-backed), anti-hotlinking, and deployment self-checks. The frontend is hybrid: a dependency-free modern homepage and an older Nuxt.js SPA for the admin panel. The codebase is well-tested with unit and e2e tests, but has technical debt from a legacy Nuxt frontend, deprecated `document.execCommand` usage, and reliance on external CDN resources for admin UI.
This repository contains a collection of deployment and management scripts for setting up and maintaining a multi-protocol proxy server (sing-box) on VPS and free hosting platforms (Serv00/Hostuno). The system automates the installation of five proxy protocols (Vless-reality, Vmess-ws, Hysteria-2, Tuic-v5, Anytls), generates TLS certificates, configures Cloudflare Argo tunnels for CDN proxying, and provides keep-alive mechanisms via cron, GitHub Actions, Cloudflare Workers, and a Node.js web server to prevent service downtime on free hosts. The primary entry points are interactive bash scripts (`sb.sh` for VPS, `serv00.sh` for Serv00) and a non-interactive keep-alive script (`serv00keep.sh`). The architecture is a set of loosely coupled shell scripts and a small Express.js application, not a monolithic service. External dependencies include sing-box, cloudflared, and standard Linux utilities. The code is functional and widely used (10k+ stars) but exhibits typical script-level craftsmanship: long monolithic functions, global variable usage, and tight coupling to specific hosting environments. The last commit date (2026-10-13) appears anomalous and likely a data error, but the repository shows active maintenance with recent stars and forks.
SYSTEM is an AI-powered macOS automation assistant enabling natural language control of Mac functions through a distributed architecture. It consists of a Tauri-based desktop app for local management, a CLI for setup/diagnostics, a local bridge server executing commands on the Mac, and a Cloudflare Worker serving as the AI agent using Anthropic's Claude. The system emphasizes privacy by keeping processing on user infrastructure, with secure Bearer token authentication between components. The architecture features a modular tool system where each capability (music, reminders, calendar, etc.) follows a consistent interface for easy extension. Communication occurs via HTTP/WebSocket: the UI sends requests to the Cloudflare Agent, which processes natural language with Claude and commands the local bridge. The bridge validates inputs, executes tools (using AppleScript/shell commands), and returns results. Real-time updates use WebSockets for scheduled tasks and notifications. Security is prioritized through command allowlisting, dangerous pattern blocking, and explicit macOS permission requirements. Key reusable components include secure command execution utilities and input validation patterns. The bridge server's validation and command modules isolate security concerns, while the tool interface pattern enables extensibility. The system is actively maintained with a pre-commit hook and low issue count, though distributed components risk drift. Dependencies show no known vulnerabilities (Dependabot Alerts: 0), but reliance on external services (Anthropic, Cloudflare) requires monitoring for API changes.