Cloudron Forum

My understanding is that this will allow apps to get the real IP when behind Cloudflare. Currently, the apps get Cloudflare's IP.

@Refugee_Ranger said in Enormous Security Hazard: Cloudron will configure Cloudflare for DNS only By default, Cloudron configures any new app for DNS only. You have to go to the Cloudflare dashboard to enable proxying. Once you enable it in Cloudflare, Cloudron will preserve the proxying flag.

@ajtatum Congrats on the success and all the learning!

@girish I did something slightly different (but maybe not SO uncommon). I created the server and put the clients domain into my own (developer) cloudflare account. After everything worked I created the domain in the client's cloudflare account and changed the NS entries (basically this: https://developers.cloudflare.com/fundamentals/get-started/basic-tasks/manage-domains/move-domain/). the situation was now, that the API key was still valid but changed the wrong domain entries at cloudflare. so, I imagine cloudron creates the NS entry, checks if this works (which it doesn't) -> brain freeze. Something like this?

@subven Sorry I wasn't clear on the domain thing. It's fixed now so no worries. I do have email working. I disabled mail in Cloudron (I don't see a use for it as it is just me), and redid the dmarc and other records that Google requires.

also read this

Just to note, it seems it was a timing issue, where the DNS in this case took longer than expected for full propagation.

In the past I have only seen the angular templates, if the browser has javascript disabled or the javascript files are not loaded. Do you see failing requests in your browser console?

@JLX89 said in Cloudflare + PTR (rDNS) Settings Compatibly: Does anyone know if there is a way around this and enable proxying on example.tld with the mail server at the same location? AFAIK, this is not possible since Cloudflare does not support proxying mail. We are using Vultr for the VPS, so rDNS needs to be setup to reflect the server host (EX: example.tld), if pushing the mail server to mail.example.tld, the rDNS would need to be updated to that. Correct. You have to set the rDNS to the name of the mail server in Vultr.

@colonelpanic said in Cloudflare Setup Questions: I assume that renewing the Let's Encrypt certificate would not be an issue with the proxy turned on because Cloudron is using a DNS challenge instead of HTTP challenge. Is that a true statement? Yes. Proxying can be left turned on, Cloudron will manage to get certs via DNS challenge. What would be the benefit of creating a Wildcard Origin Cert on Cloudflare and uploading it instead of using Let's Encrypt? AFAIK, there is no benefit. I think the wildcard origin cert is intended for cases where one cannot get a valid cert via DNS or HTTP automation (like some intranets that block outbound access).

Okay, this was kinda weird. Did register the domain and added it to CloudFlare. Got the error "invalid domain" while adding it on Cloudron. Got the error while using CloudFlare, but also with wildcard. As I had some other work to do, didn't really check after my post. As I tried to add it to Cloudron for a screenshot and after that the manual solution, it suddenly worked, while having selected CloudFlare. So maybe there was a problem with resolving the domain before, but it is working now at least.

yeah, I am not sure what changed on Cloudflare side, but we had to do this on our servers as well.

@girish Nice, thank you. Have just added them manually. Be double-nice if they were added automatically when Cloudflare is first used as a DNS Proxy, but I guess I understand that's both an additional feature to maintain, and maybe debatable if everyone would want it happening silently.

@silvermaw no worries, happens to the best

Solved. It was a small misconfiguration on the registrar side. Thanks!

@jagan personally I stay away from all things Cloudflare. Like the Tech Giants they are in the business of surveillance cspitalism and are massively over centralising the Internet. See also stuff like https://tech.tiq.cc/2016/01/why-you-shouldnt-use-cloudflare/

@opensourced said in Unable to install apps: @girish I moved the appsdata folder to another mounted drive I think you should have led with that...

unfortunately, i also had an issue with it. basically what i did, i put my testing page https://wp-test.blindsoft.net through it, using a docker container, sense i like using docker. then i put the hostname as wp-test. unfortunately, it only shows a 502 gateway error.

I didn't know Argo tunnels were free. So one can hide the mail service and put it thru an Argo tunnel on a subdomain to the world. https://docs.ibracorp.io/all-guides-in-order/documentation/cloudflare-tunnel Similarly one can have another domain and IP handle the incoming, which is tunneled to you via Tailscale. https://docs.ibracorp.io/all-guides-in-order/documentation/tailscale