I'm building a privacy centric React app that does all the work client side, using a server only for the static files required for the app to run.
I don't want to expose users to Cloudflare or similarly gag-order / mitm prone services that could theoretically intercept and alter client code that reaches users' browsers. At the same time, I don't want to expose the servers hosting the static files to the world. What are some options to achieve both goals?
One could acquire VPS nodes in multiple VPS providers around the world and use something like HAproxy to be the outer-ring of protection and NGinx as a middle ring of memory caching on a different set of VPS accounts and use Wireguard to encrypt the traffic between nodes. Use a different VPS/server provider for your React nodes. Not perfect but perfect is the enemy of good so I am told. It's a bit of work but I think at least attempts to mitigate your concerns. Using something like UltraDNS one could serve up the closest cache node to the visitor via DNS. Not as good as Anycast but only a couple VPS providers support Anycast.