# Only allow Cloudflare IPs for Discourse server

**URL:** <https://meta.discourse.org/t/only-allow-cloudflare-ips-for-discourse-server/70489>\
**Category:** Self-hosting\
**Created:** [21. September 2017 um 06:01 UTC](https://meta.discourse.org/t/only-allow-cloudflare-ips-for-discourse-server/70489 "2017-09-21T06:01:47Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![Brock\_Busby](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/brock_busby/32/118746_2.png) [@Brock\_Busby](https://meta.discourse.org/u/Brock_Busby)\
**Post date:** [21. September 2017 um 19:49 UTC](https://meta.discourse.org/t/only-allow-cloudflare-ips-for-discourse-server/70489/7 "2017-09-21T19:49:26Z")

</div>

Also not being familiar with nginx and yaml, I followed your instructions @riking and created a copy named `./templates/cloudflare.allowdeny.yml` with the following code.

Can you please verify this will do the job? Much appreciated.

```plaintext
run:
  - file:
      path: /tmp/add-cloudflare-ips
      chmod: +x
      contents: |
        #!/bin/bash -e
        # Download list of CloudFlare ips
        wget https://www.cloudflare.com/ips-v4/ -O - > /tmp/cloudflare-ips
        wget https://www.cloudflare.com/ips-v6/ -O - >> /tmp/cloudflare-ips
        # Make into nginx commands and escape for inclusion into sed append command
        CONTENTS=$(</tmp/cloudflare-ips sed 's/^/allow /' | sed 's/$/;/' | tr '\n' '\\' | sed 's/\\/\\n/g')

        echo CloudFlare IPs:
        echo $(echo | sed "/^/a $CONTENTS")
        echo "deny all;"
        # Insert into discourse.conf
        sed -i "/sendfile on;/a $CONTENTS\nreal_ip_header CF-Connecting-IP;" /etc/nginx/conf.d/discourse.conf
        # Clean up
        rm /tmp/cloudflare-ips

  - exec: "/tmp/add-cloudflare-ips"
  - exec: "rm /tmp/add-cloudflare-ips"

```

---

_[View the full topic](https://meta.discourse.org/t/only-allow-cloudflare-ips-for-discourse-server/70489)._