@jagadeesh-s2104 a user had some success with argo tunnel as reported here - https://forum.cloudron.io/topic/5714/argo-tunnels . We haven't tried this ourselves.

Just to note, it seems it was a timing issue, where the DNS in this case took longer than expected for full propagation.

@danteswrath this is very strange then. Maybe you can send a mail with your public IP to support@cloudron.io so we can test this from here.

@JLX89 said in Cloudflare + PTR (rDNS) Settings Compatibly:

Does anyone know if there is a way around this and enable proxying on example.tld with the mail server at the same location?

AFAIK, this is not possible since Cloudflare does not support proxying mail.

We are using Vultr for the VPS, so rDNS needs to be setup to reflect the server host (EX: example.tld), if pushing the mail server to mail.example.tld, the rDNS would need to be updated to that.

Correct. You have to set the rDNS to the name of the mail server in Vultr.

@colonelpanic said in Cloudflare Setup Questions:

I assume that renewing the Let's Encrypt certificate would not be an issue with the proxy turned on because Cloudron is using a DNS challenge instead of HTTP challenge. Is that a true statement?

Yes. Proxying can be left turned on, Cloudron will manage to get certs via DNS challenge.

What would be the benefit of creating a Wildcard Origin Cert on Cloudflare and uploading it instead of using Let's Encrypt?

AFAIK, there is no benefit. I think the wildcard origin cert is intended for cases where one cannot get a valid cert via DNS or HTTP automation (like some intranets that block outbound access).

Okay, this was kinda weird. Did register the domain and added it to CloudFlare. Got the error "invalid domain" while adding it on Cloudron. Got the error while using CloudFlare, but also with wildcard.
As I had some other work to do, didn't really check after my post. As I tried to add it to Cloudron for a screenshot and after that the manual solution, it suddenly worked, while having selected CloudFlare. So maybe there was a problem with resolving the domain before, but it is working now at least.

yeah, I am not sure what changed on Cloudflare side, but we had to do this on our servers as well.

@nj said in Issues when using Cloudflare Proxy service for Cloudron:

Even if I'm using Cloudflare DNS Provider using API Token, Cloudron adds an A-Record but the certificate error still shows up because the A-Record is still in DNS-Only mode. If Cloudron gave an option to set the A-Record in Proxy Mode while installing the app, I didn't have to go to Cloudflare and change the record from DNS Only mode to Proxied Mode and wait for DNS to propagate.

This is the best way to do it.

Add the domain in Cloudron with Cloudflare DNS provider Cloudron will always add the A record in DNS Mode. Go to Cloudflare, and turn on proxying. For future DNS changes to this domain, Cloudron has code to "persist" the proxying flag. Just noting this down, since we have code explicitly for this use case.

I agree having a checkbox or something at app install time to enable proxying would be nice.

@silvermaw no worries, happens to the best 🙂

Solved. It was a small misconfiguration on the registrar side. Thanks!

@jagan personally I stay away from all things Cloudflare. Like the Tech Giants they are in the business of surveillance cspitalism and are massively over centralising the Internet. See also stuff like https://tech.tiq.cc/2016/01/why-you-shouldnt-use-cloudflare/

@opensourced said in Unable to install apps:

@girish I moved the appsdata folder to another mounted drive

I think you should have led with that... 🙂

@doodlemania2
I don't use cloudron and I only commented as when I was looking for the specific cloudflare error:

The service may be down or it may not be responding to traffic from cloudflared: x509: certificate is not valid for any names, but wanted to match localhost" cfRay=6957204cbdeb1fb9-SJC ingressRule=0 originService=https://localhost

I landed here from Google and I know that in the future, I will probably have this issue again and forget the solution.
So I'm posting this more for future me.

However, this would solve that specific issue that @girish was having,

I got my services up and going that used a self signed ssl cert and was able to proxy it with cloudflare.

It would be cool to try cloudron as it sounds like a really great product, but I personally don't have the budget for it at the moment.

I didn't know Argo tunnels were free. So one can hide the mail service and put it thru an Argo tunnel on a subdomain to the world.

https://docs.ibracorp.io/all-guides-in-order/documentation/cloudflare-tunnel

Similarly one can have another domain and IP handle the incoming, which is tunneled to you via Tailscale.

https://docs.ibracorp.io/all-guides-in-order/documentation/tailscale

@comtop1 Did you get this sorted out? Usually, I have seen disabling and re-enabling cloudflare proxy fixes things. Seems to be some in Cloudflare SSL proxy caching.

@austin I was noticing the CF API having issues yesterday, so it's likely you just had an intermittent failure. A retry would have been sufficient.

@alexsunny123 ok there are quite a few variables in the mix here it seems. For a start, can you connect to the Cloudron setup view using the public IP address from your ISP on port 80 and 443?

To rule out some other maybe interfering parts, disable the Cloudflare proxying.

Since you mentioned email, on a residential connection you will most likely require a mail relay to work properly, anyways port 25 will most likely be blocked by your ISP. Cloudron as mail relay support for various providers though.

Lastly for Cloudron it doesn't really matter if bare-metal or VM, so there are no special docs about this. You should be fine as long as you have vanilla Ubuntu 20.04 server installed.

@girish yep, it loads, awesome, thank you👍 😊

@guyds Ah, good to know. Did not know this limitation!

Makes a lot of sense.

@theciscogeek When using Cloudflare, we have a check as to whether it's proxying and we skip the DNS propagation checks - https://git.cloudron.io/cloudron/box/-/blob/master/src/dns/cloudflare.js#L274

@robi yeah, with ecommerce being our primary business, we're invested in this. We have 12 very experienced devs on the team but just a few of them have had time to start looking at Cloudron this week. In this for the long-term though so I'm sure you'll start to see our work filtering through very soon.

@Lonk Yup, that sounds right. In fact, it seems that Cloudflare made the nginx+http3 patch (but not sure if nginx itself ended up using that).

Thanks, now I understand

Truly heroic support! 🙌 Happy to know this is covered and tested 🙂

@girish

This is intentional because the root domain record can be in use on another server/app/website.

Right, that makes sense.

I added a redirect from the root domain and it solved all my problems. Thanks for the quick help.

@girish Done - https://forum.cloudron.io/topic/3777/support-optional-cloudflare-proxied-record-creation

So, it seems like giving the app a "relocation" by pressing the save button under the Location config tab & a quick Cloudflare proxy off-on, and then some time is the fix.

EDIT
So it is Cloudflare that is the problem and not Cloudron. Specifically their proxy