Site is accessible on the IP address when not following th install guide

I just tested launching 2 Discourse instances on Digital Ocean using their market place app to quickly launch them.

I wanted to test this with virtually zero custom configuration, just editing smtp, dev email and discourse_hostname with bogus details (to allow the rebuild).

The installer stops due to the bogus domain/subdomain I set not passing the domain validation step (and recommends editing the app.yml file manually then rebuilding).

After editing the app.yml and rebuilding (smtp, dev email, discourse_hostname only), the site is available insecurely on the IP address without any involvement of Cloudflare. It doesn’t redirect to the set discourse_hostname.

Most of my installs didn’t use the Digital Ocean market place app to set up, but were done manually using the standard docker install guide.

Note that, the installer stopping due to not being able to validate the domain also happened on two recent installs I did that used Cloudflare, probably because of the proxying. The other installs were done before there was a domain validation step in the installer.

edit: Note that only 2 of the 8 Discourse installs had any domain verification issue during the initial install (not including the two testing instances made above). The Discourse set up script suggests the user to edit the app.yml manually and rebuild on domain verification error. No problem if this isn’t useful though, this wasn’t a solution for myself.

edit: Generally using Cloudflare flexible SSL, not letsescrypt (which would be better). Thanks @neounix.