dsaver reports that file uploads via AWS S3 fail when Cloudflare’s proxy (orange cloud) is enabled on their Discourse instance (installed via DigitalOcean’s market-app), but work fine with the proxy off (gray cloud). They’ve added cloudflare.template.yml to app.yml and rebuilt, confirming the issue is tied to Cloudflare’s proxy. pfaffman explains that the template only fixes IP logging and suggests disabling Cloudflare’s optimizations under Speed settings as a workaround, though notes gray cloud is the safest option. dsaver clarifies they must use orange cloud due to frequent DDoS attacks. pfaffman advises checking Cloudflare’s Speed/Optimization settings and questions whether the DDoS threat is real, noting Discourse’s built-in rate limiting may not suffice for distributed attacks. He adds he’s testing orange cloud with direct uploads (not S3). dsaver confirms disabling all Speed optimizations didn’t resolve the issue. In post 6, they ask if others face the same problem, suspecting they’re not alone. The core issue remains unresolved: S3 uploads break under Cloudflare’s orange cloud despite configuration attempts.
Hi, I have a discourse running on a DigitalOcean droplet installed using the market-app option. If I keep the CF proxy off (gray cloud), file upload through S3 works fine.
If I open the CF proxy (orange cloud), file upload fails and the system suggests “Sorry, there was an error uploading that file. Please try again.”
I installed the - "templates/cloudflare.template.yml" in the app.yml and rebuilt it to make sure everything is updated.
I have tried and tested a million times, and the only thing that is changed is CF proxy. So I’m pretty sure it’s CF proxy causing the failure. My server gets DDoS often so CF proxy is helpful. How should I make it work?
That just allows Discourse to find the user’s IP address instead of having it show as cloudflare’s IP address.
The best way is to use the gray cloud. But if you want to spend more time on it, you can contrive to disable the various speed-up offerings. There are some topics where it’s discussed.
Somewhere in cloudflare (maybe under Speed/optimization?) you should turn off all of cloudflare’s optimizations. And somewhere here are some topics that discuss it, though at first glance finding ones that have actual solutions is not easy. But maybe google “disable cloudflare optimizations”.
Is your DDOS issue real or imagined? Discourse has by default rate limiting (which won’t help with DDOS that’s very distributed). If you’re running a community that attracts DDOS folks then you should know that running Discourse in a way that the IP address isn’t leaked is pretty tricky.
All that to say that I’m currently working on something that has cloudflare using the orange cloud. I’ll double-check that uploads are working.
EDIT: Oh, but I was using direct uploads, not S3 uploads.