Cloudron Forum

Thank you @laurent I'll try something like that.

@robi I think the user put zone restrictions on his existing API keys. The Cloudron zone was not part of the API key.

Great write-up thanks for sharing all those insights, this will surely help users down the line 🙂

@girish said in trying to use cloudron openid connect with cloudflare0trust:

@

ok i tryed that.
only problem, it keeps changing the token, the zero-trust does. everytime i put it in, it puts like 34more bullets (what i hear on the screen reader when trying to enter) in the tokens field.

So I think I've found the solution.
Modify the Proxy Host config > Advanced and paste the following:

set_real_ip_from 03.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 108.162.192.0/18; set_real_ip_from 131.0.72.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 162.158.0.0/15; set_real_ip_from 172.64.0.0/13; set_real_ip_from 173.245.48.0/20; set_real_ip_from 188.114.96.0/20; set_real_ip_from 190.93.240.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.128.0/17; #use any of the following two real_ip_header CF-Connecting-IP; #real_ip_header X-Forwarded-For;

this will allow True Client IP Address to be passed to Cloudron.

Are you also using the domain outside of Cloudron? I am surprised you hit any limit at all, Cloudron API usage is quite low.

Thank you for your help. Website filing is to register the services provided by this server to improve network security. When I tried to use servers in other countries, it was very successful, thank you for your help, and wish you success in your work!

@ghstandard that feature is coming in 7.5.1 which we will stage tomorrow.

ahhh, so just have to nix cloudflare altogether, thanks!
confused myself because my plains.cloud is cloudflared, but mail.plains.cloud specifically is not!
appreciate the clarification 🙂

Sometimes it's browser cache related as well, so make sure to use Shift-reload after major changes like this.

@imc67 said in Too many redirects when using Cloudflare DNS proxy:

@Grienauer said in Too many redirects when using Cloudflare DNS proxy:

I also had this problem.
After researching etc, the solution is to set the SSL/TSL to Kustom -> FULL.

Wow! Thanks for this very valuable information because now I’m finally able to use Cloudflare’s WAF!! (Cloudron as well as NetCup doesn’t have a WAF to ie. geoblock wp-login.php or other login pages).

Certainly no equivalent to WAF but we do have blocklists to geoblock: https://docs.cloudron.io/guides/community/blocklist-updates/

Alright, I've got another update and seemed to have reworked things so this is fixed. I've removed all of the old rules and created a new one under WAF Rules using the following:

(http.host eq "https://my.cloudron.tld" and ip.src eq 127.0.0.1 and http.request.uri.path contains "/filemanager/") or (http.request.uri.path contains "/api/v1/apps")

Then take action: Skip Log matching requests: turned on WAF components to skip: All managed rules More components to skip: Managed rules (previous versions)

Note: Edit the items in bold to reflect your Cloudron Domain and your IP Address.

@girish you hit the nail on the head. that was 100% what was going on but odd that it only started doing it recently. honestly, if I could use anybody else but Cloudflare, I would. #takingsuggestions

Hi @JOduMonT,

I ran Cloudron with a combination of Tailscale & Cloudflared for two weeks without a public IP at my home setup. So far, everything was working well and I didn't encounter any significant issues. Below is the process that I followed:

1# I had two servers - one for Cloudron and the second with docker and docker-compose. Tailscale was installed and configured with Tailscale IP on both servers. The automatic domain configured was disabled in Cloudron and was set manually.

2# I ran the docker-compose.yml file on the second server using the following:

version: '3.8' services: tunnel: image: 'ghcr.io/shmick/docker-cloudflared' container_name: tunnel hostname: tunnel restart: unless-stopped user: 1000:1000 env_file: - $PWD/tunnel.env volumes: - /etc/timezone:/etc/timezone:ro command: tunnel run network_mode: host TUNNEL_TOKEN={TUNNEL-TOKEN}

3# I set up and configured the domain in the Cloudflared UI, and used HTTPS for the Cloudron Tailscale IP with No TLS Verify enabled.

@Mad_Mattho So the way I understand it, because This tunnel is initiated from my server to cloudflare, I don't have any need to open very many ports on the server, and because I am using a CNAME record to point my DNS to the tunnel ID (no publicly routable IP addresses involved anywhere) it will make no difference where in the world this machine is, or what IP address it gets its internet from, as long as it has internet and can open the tunnel to cloudflare it should just be automatically online, and with the bare minimum amount of ports open, is that correct? Sounds good.

@j_vmess your domain works just fine for me here. Maybe it's a browser cache issue? Have you tried another browser or after clearing the browser cache? I removed your domain from the original post, since it was showing the setup screen.

This can be set to solved !

Cloudflare reply :

c09bd926-0b5e-4850-8e26-b9413779a021-image.png

Praise 🙏🙏🙏🙏 for Cloudron's backup system: This is amazing! Digital Ocean charges 30% of the cost of the droplet for daily backups. If your droplet uses Cloudron, you can just use the built in backup to R2 for free and could even have it backup multiple times per day. So cool. Amazing cloudflare is offering so much free storage with r2 as well. I guess eventuallly they may change this but Cloudflare makes integrations so easy it seems trivial to just switch things over to s3 or Backblaze if that time comes. That said, I guess I haven't had to restore from a backup before so this is more just praise for the setup ease but I have faith in Cloudron team based on care I see with the product and in this forum!

@girish Oh great, that seems good then, happy to test it when it's available !

@girish ok, understood