Basically I handle all the logic in Firebase rules and lambdas. Any destructive action goes through a GCF that updates the Firebase Realtime Database. Actions that happen often (like moving) are updated directly by the client but validated with some overly complicated Firebase rules.
It's very nice not having to worry about servers and scaling, but it can be a really painful development experience.
Let me know if you want to try it out and I'll post the URL.