In a discussion about running Discourse behind a Cloudflare Tunnel, kuydiyadri reports successfully installing Discourse and using Cloudflare Tunnel but faces two issues: (1) After enabling Cloudflare’s Under Attack Mode (UAM) to mitigate DDoS, Discourse performance degrades and visitor IPs appear as localhost or tunnel IPs — they ask how to retrieve real visitor IPs. ghassan replies that the real IP should be available via the X-Real-IP header, referencing Cloudflare’s documentation. (2) They also ask whether Let’s Encrypt certificates can auto-renew behind the tunnel or if they must switch to Cloudflare’s SSL. syandriz clarifies that Cloudflare handles SSL termination and auto-renewal when using the proxy (orange cloud) mode, making Let’s Encrypt renewal unnecessary on the server. kuydiyadri confirms they’ve tried configuring the app.yml without success and asks for step-by-step guidance. pfaffman asks if they added the Cloudflare template, to which kuydiyadri replies they tried both with and without it, still getting the same Nginx result. They also mention that iplogger.org still reveals their real IP and seek advice on hiding it.
i have successfully installed discourse and i put my server into cloudflare tunnel.
I have a few things to ask here..
after I had a ddos attack that was so rough, I activated UAM (under attack mode) and it managed to prevent ddos attacks, but I got discourse that couldn’t run smoothly with UAM, so I wanted to block it via ip, after I saw. apparently i get only ip from same(either localhost or from tunnel itself), how do i get real ip from visitor? if anyone can answer, please provide how. sorry I’m too new here.
after putting server in cloudflare tunnel…
i still use Let Encrypt.. can the SSL from Let Encrypt be updated(i mean renew), or do I have to use the SSL from cloudflare itself? I haven’t had any success using SSL from cloudflare yet. there are friends here want to show how.?
maybe that’s all I want to ask first for now. before that. to the kind friend who answered, I thank you very much
When you put your server behind Cloudflare Tunnel, the SSL certificate management is typically handled by Cloudflare rather than Let’s Encrypt directly. Cloudflare offers its own SSL/TLS certificates, which are managed and automatically renewed by Cloudflare.
When you enable the Cloudflare DNS mode proxy (orange cloud), the traffic between the client and Cloudflare is encrypted using Cloudflare’s SSL certificate. Cloudflare handles the SSL termination and then communicates with your server over the tunnel using its own certificate.
As a result, you don’t need to worry about renewing the Let’s Encrypt certificate on your server directly. Cloudflare will manage the SSL/TLS certificate for the domain and handle the renewal process automatically.
It’s worth noting that when using Cloudflare’s SSL certificate, the SSL handshake between the client and Cloudflare happens at the edge server, reducing the load on your server and potentially improving performance.
Yes i do with and without still Nginx give me same result. Mr @pfaffman
i dont know how.
and may i know why iplogger(dot)org still get my real ip, do you have any advice to hide my ip from that.