Flarum+Cloudflare Full SSL - Nginx Configuration

Chope

clarkwinkelmann
Is it available to the subscribers of the free plan on Cloudflare?

clarkwinkelmann

Chope Is it available to the subscribers of the free plan on Cloudflare?

It sure is ? Don't have any paid plan myself yet

tankerkiller125

I would also recommend rewriting the IP addresses from the CloudFlare ones to the users real IP for logging purposes. I usually make a file called cloudflare_ips in the /etc/nginx directory and then input the following

set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 199.27.128.0/21;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;

# use any of the following two
real_ip_header CF-Connecting-IP;

then I use include cloudflare_ips; inside the server brackets.

BajpanGosh

clarkwinkelmann redirect rule not working

server {

    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;

}

server {

    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

Alkir

And how to implement it on a hosting? Apache server using xampp

clarkwinkelmann

Alkir what are you referring to ? This discussion is about nginx.

Are you talking about Cloudflare Origin certificates ? It's no different than manually installing any certificate on your server. I believe even Cloudflare gives you the instructions right when you create the Origin certificate.

jordanjay29

Alkir Apache server using xampp

Cloudflare only works on web servers hosted online as well, not local servers. Once you have a web host that uses nginx, you can use the prescribed method.

Alkir

No, I mean, how to install full ssl on hosting, not on vps

[deleted]

Alkir No, I mean, how to install full ssl on hosting, not on vps

If you go the "Strict SSL" route, you will need the CF root CA installed on your shared hosting, as well as the certificate they issue you. It won't work without it.

Flexible is "ok", but not really recommended as this simply encapsulates the session with forced SSL, but does not provide any real security at the shared hosting level.

[deleted]

This seems too hard for me, let me know it will be ok if I set up from here and proxied my ip with Cloudflare then it is ok or not

Or I will have to set up like above.....

I am really sorry about the silly question

luceos

[deleted] use flexible if your site on your server has no SSL, this will allow CF to upgrade your connection making the non https a https connection when serving the content.

clarkwinkelmann

[deleted] you will need the CF root CA installed on your shared hosting

Do you really need that? I've always used origin certificates directly with the "custom certificate" settings on my managed hostings. Though I've never tried on shared hostings, just managed VPSs

[deleted]

clarkwinkelmann Sadly, on shared hosting, I've always needed this. Usually always on cPanel