@girish ok, understood

okay, i'll try it running on ubuntu using virtual machine.. .

You can read more here - https://support.cloudflare.com/hc/en-us/articles/115000219871-Troubleshooting-redirect-loop-errors-

My understanding is that this will allow apps to get the real IP when behind Cloudflare. Currently, the apps get Cloudflare's IP.

@Refugee_Ranger said in Enormous Security Hazard:

Cloudron will configure Cloudflare for DNS only

By default, Cloudron configures any new app for DNS only. You have to go to the Cloudflare dashboard to enable proxying. Once you enable it in Cloudflare, Cloudron will preserve the proxying flag.

@ajtatum Congrats on the success and all the learning! 😎

@girish I did something slightly different (but maybe not SO uncommon). I created the server and put the clients domain into my own (developer) cloudflare account. After everything worked I created the domain in the client's cloudflare account and changed the NS entries (basically this: https://developers.cloudflare.com/fundamentals/get-started/basic-tasks/manage-domains/move-domain/).

the situation was now, that the API key was still valid but changed the wrong domain entries at cloudflare. so, I imagine cloudron creates the NS entry, checks if this works (which it doesn't) -> brain freeze. Something like this?

@subven Sorry I wasn't clear on the domain thing. It's fixed now so no worries. I do have email working. I disabled mail in Cloudron (I don't see a use for it as it is just me), and redid the dmarc and other records that Google requires.

@girish thank you!

Just to note, it seems it was a timing issue, where the DNS in this case took longer than expected for full propagation.

Unfortunately, we could never figure out why port forwarding does not work with @danteswrath 's router.

@danteswrath If you like you can open a new thread here with your router information and maybe someone knows how to configure it properly.

@JLX89 said in Cloudflare + PTR (rDNS) Settings Compatibly:

Does anyone know if there is a way around this and enable proxying on example.tld with the mail server at the same location?

AFAIK, this is not possible since Cloudflare does not support proxying mail.

We are using Vultr for the VPS, so rDNS needs to be setup to reflect the server host (EX: example.tld), if pushing the mail server to mail.example.tld, the rDNS would need to be updated to that.

Correct. You have to set the rDNS to the name of the mail server in Vultr.

@colonelpanic said in Cloudflare Setup Questions:

I assume that renewing the Let's Encrypt certificate would not be an issue with the proxy turned on because Cloudron is using a DNS challenge instead of HTTP challenge. Is that a true statement?

Yes. Proxying can be left turned on, Cloudron will manage to get certs via DNS challenge.

What would be the benefit of creating a Wildcard Origin Cert on Cloudflare and uploading it instead of using Let's Encrypt?

AFAIK, there is no benefit. I think the wildcard origin cert is intended for cases where one cannot get a valid cert via DNS or HTTP automation (like some intranets that block outbound access).

Okay, this was kinda weird. Did register the domain and added it to CloudFlare. Got the error "invalid domain" while adding it on Cloudron. Got the error while using CloudFlare, but also with wildcard.
As I had some other work to do, didn't really check after my post. As I tried to add it to Cloudron for a screenshot and after that the manual solution, it suddenly worked, while having selected CloudFlare. So maybe there was a problem with resolving the domain before, but it is working now at least.

yeah, I am not sure what changed on Cloudflare side, but we had to do this on our servers as well.

@ajtatum yeah as @benborges said, there's no way to proxy MX via Cloudflare afaik.

@silvermaw no worries, happens to the best 🙂

Solved. It was a small misconfiguration on the registrar side. Thanks!

@jagan personally I stay away from all things Cloudflare. Like the Tech Giants they are in the business of surveillance cspitalism and are massively over centralising the Internet. See also stuff like https://tech.tiq.cc/2016/01/why-you-shouldnt-use-cloudflare/

@opensourced said in Unable to install apps:

@girish I moved the appsdata folder to another mounted drive

I think you should have led with that... 🙂

@doodlemania2
I don't use cloudron and I only commented as when I was looking for the specific cloudflare error:

The service may be down or it may not be responding to traffic from cloudflared: x509: certificate is not valid for any names, but wanted to match localhost" cfRay=6957204cbdeb1fb9-SJC ingressRule=0 originService=https://localhost

I landed here from Google and I know that in the future, I will probably have this issue again and forget the solution.
So I'm posting this more for future me.

However, this would solve that specific issue that @girish was having,

I got my services up and going that used a self signed ssl cert and was able to proxy it with cloudflare.

It would be cool to try cloudron as it sounds like a really great product, but I personally don't have the budget for it at the moment.

I didn't know Argo tunnels were free. So one can hide the mail service and put it thru an Argo tunnel on a subdomain to the world.

https://docs.ibracorp.io/all-guides-in-order/documentation/cloudflare-tunnel

Similarly one can have another domain and IP handle the incoming, which is tunneled to you via Tailscale.

https://docs.ibracorp.io/all-guides-in-order/documentation/tailscale

@comtop1 Did you get this sorted out? Usually, I have seen disabling and re-enabling cloudflare proxy fixes things. Seems to be some in Cloudflare SSL proxy caching.

@austin I was noticing the CF API having issues yesterday, so it's likely you just had an intermittent failure. A retry would have been sufficient.

@alexsunny123 ok there are quite a few variables in the mix here it seems. For a start, can you connect to the Cloudron setup view using the public IP address from your ISP on port 80 and 443?

To rule out some other maybe interfering parts, disable the Cloudflare proxying.

Since you mentioned email, on a residential connection you will most likely require a mail relay to work properly, anyways port 25 will most likely be blocked by your ISP. Cloudron as mail relay support for various providers though.

Lastly for Cloudron it doesn't really matter if bare-metal or VM, so there are no special docs about this. You should be fine as long as you have vanilla Ubuntu 20.04 server installed.

@girish yep, it loads, awesome, thank you👍 😊

@humptydumpty done

Makes a lot of sense.