Cloudflare proxy

Flarumist

SKevo No, all forums are proxied through Cloudflare as well.

Oh, that’s a bit confusing, I don’t think that’s what is said in the privacy policy:

Cloudflare, for proxying requests made to the main FreeFlarum website to guard the service against attacks and other potential internet thread[t]s;
https://docs.freeflarum.com/en/legal/privacy-policy/#third-party-services-software-used-by-freeflarum

So, this description implies that only the main website is proxied, not the forums created by users. I think it should be corrected if it’s not the case.

That said, I don’t see explicit Cloudflare requests on my forum (which I do see on this forum) using a custom domain. I saw the following line in the docs:

Make sure to disable the Cloudflare proxy, so that the icon is grey (not orange).
https://docs.freeflarum.com/en/tutorials/custom-domain

I don’t see such an option in the FreeFlarum settings area, so does this mean that the setting is implied if you set up a custom domain? Or do you mean with this that when the custom domain is offered by Cloudflare, the user should set it to unproxied there?
And does this mean that forums using a custom domain are not proxied through Cloudflare?

~~(I apologize that this went a bit off-topic, perhaps the discussion needs to be split now 🙈)~~

SKevo

Flarumist So, this description implies that only the main website is proxied, not the forums created by users. I think it should be corrected if it’s not the case.

You are right, this is an oversight and my bad. I will correct that, thank you for letting me know!

Flarumist That said, I don’t see explicit Cloudflare requests on my forum (which I do see on this forum) using a custom domain.

This forum recently migrated to Blomstra server in order to ensure uptime in case of a FreeFlarum server failure (https://support.freeflarum.com/d/2/17). I assume that they use a paid Cloudflare plan to ensure that requests to custom domains are proxied too.

FreeFlarum uses the Cloudflare free tier. If the proxy would be on (also on FreeFlarum side), users would get the “Cross CNAME User Banned” message. That’s why we instruct users to keep the proxy off:

Make sure to disable the Cloudflare proxy, so that the icon is grey (not orange).
https://docs.freeflarum.com/en/tutorials/custom-domain

I don’t see such an option in the FreeFlarum settings area, so does this mean that the setting is implied if you set up a custom domain? Or do you mean with this that when the custom domain is offered by Cloudflare, the user should set it to unproxied there?

That is not in the FreeFlarum settings, it’s in the Cloudflare DNS area actually. I am sorry if the documentation implied that wrongly too, I will try to word it better.

defaultuser6

Flarumist You may try it.

defaultuser6

SKevo That’s why we instruct users to keep the proxy off:

But I think that I found a good solution,close proxy to bind freefalrum cname first,after freeflarum binding succeed,open you proxy.
I used this solution and it work.

Flarumist

Thanks for improving the description in the docs, they’re much clearer now 🙂

Cloudflare, for proxying requests made to the main FreeFlarum website and forums that are using one of the available FreeFlarum domains

Just to be absolutely certain: this means that using xxx.freeflarum.com or xxx.flarum.cloud to access your forum would proxy the forum via Cloudflare, whereas using your own domain with a CNAME record will disable everything Cloudflare?

SKevo

Flarumist Just to be absolutely certain: this means that using xxx.freeflarum.com or xxx.flarum.cloud to access your forum would proxy the forum via Cloudflare, whereas using your own domain with a CNAME record will disable everything Cloudflare?

Yes, that is correct. FYI, I can also disable the proxy for an individual forum on freeflarum.com / flarum.cloud domain, should anyone request that

Flarumist

SKevo Great, then all is clear to me! Thanks so much for your patience 😃

SKevo FYI, I can also disable the proxy for an individual forum on freeflarum.com / flarum.cloud domain, should anyone request that

That’s good to know, and I suppose it would be useful if this bit of info would also be in the docs, apart from what’s already in the privacy statement? Something like:

“If your forum is accessible via <you>.freeflarum.com or <you>.flarum.cloud, it is proxied through Cloudflare to guard the service against attacks and other potential internet threats. On request, the Cloudflare proxy can be disabled for your forum. Cloudflare is never used if you specify your own domain name (tutorial).”

Also, just a typo in the privacy policy: it’s “threats”, not “threads” in this case.

SKevo

Flarumist Cloudflare is never used if you specify your own domain name

Well, this is not entirely true - I omitted technical details for brevity and to not complicate it, my apologies. Actually, the proxy can be turned on after you link your custom domain (it is initially supposed to be turned off so that FreeFlarum can properly recognize the DNS records and generate a SSL certificate for the domain, etc.). If you turn the proxy on after you link your custom domain, you can get the benefit of Cloudflare’s features, otherwise nothing would be proxied and your domain would be vulnerable after you link it.

It’s just that we do not officially support it, because I assume that Cloudflare doesn’t support it either (and I sometimes observe that this does not always work). For example, the free plan does not allow for cname.freeflarum.com to be proxied, as that would generate the “Cross CNAME User Banned” message (for custom domains that switch the proxy on).
If I remember correctly, in order for the cname.freeflarum.com to be proxied, we’d need the Cloudflare for SaaS plan. So, all of this is just some cumbersome way around it that I have tested and that “just works”. Of course, I admit that I am no DNS/WAF expert and I could be missing something and there is another way that solves all of the above-mentioned problems. But for now, this works.

Flarumist Also, just a typo in the privacy policy: it’s “threats”, not “threads” in this case.

Thanks, I fixed that now 👍️

SKevo

defaultuser6 indeed that should work, I have explained this behaviour above:

SKevo Actually, the proxy can be turned on after you link your custom domain (it is initially supposed to be turned off so that FreeFlarum can properly recognize the DNS records and generate a SSL certificate for the domain, etc.). If you turn the proxy on after you link your custom domain, you can get the benefit of Cloudflare’s features, otherwise nothing would be proxied and your domain would be vulnerable after you link it.