# שימוש ב-Discourse עם Cloudflare: שיטות עבודה מומלצות **URL:** https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405 **Category:** Self-Hosting **Tags:** how-to, cloudflare **Created:** [30 בינואר,‏ 2024,‏ 2:56am UTC](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405 "2024-01-30T02:56:10Z") **Posts on this page:** 1 **Showing post:** 1
### Author: ![Discourse](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/discourse/32/148734_2.png) [@Discourse](https://meta.discourse.org/u/Discourse) #### Post date: [30 בינואר,‏ 2024,‏ 2:56am UTC](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405/1 "2024-01-30T02:56:10Z")
# Using Discourse with Cloudflare > 🔖 This guide explains how to configure and use Discourse with Cloudflare, including security best practices and troubleshooting tips. > > 🙋 Required user level: Administrator > > ℹ Console access is required for self-hosted installations ## Summary Cloudflare can enhance your Discourse instance with improved performance through CDN, additional security layers like DDoS protection, and HTTPS support. This guide covers the setup process and best practices for optimal configuration. ## Why use Cloudflare with Discourse Using Cloudflare with your Discourse instance provides several key benefits: - **Performance** : Cloudflare’s CDN can improve worldwide access to common assets, enhancing user experience globally ([source](https://meta.discourse.org/t/enable-a-cdn-for-your-discourse/14857/1)) - **Security** : Additional protection layers including: - DDoS protection ([source](https://developers.cloudflare.com/ddos-protection/)) - HTTPS support ([source](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/)) (alternative to [Discourse’s Let’s Encrypt setup](https://meta.discourse.org/t/set-up-https-support-with-lets-encrypt/40709)) > ⚠ For self-hosted installations, while Cloudflare offers these benefits, it adds complexity to your setup. ## Setting up Cloudflare 1. Familiarize yourself with [Cloudflare Fundamentals](https://developers.cloudflare.com/fundamentals/) 2. Follow the [setup directions](https://developers.cloudflare.com/fundamentals/setup/) to configure Cloudflare for your domain and get the [security, performance, and reliability benefits](https://developers.cloudflare.com/fundamentals/concepts/how-cloudflare-works/) ## Configuration best practices ### DNS settings - Ensure DNS records pointing to your Discourse instance are proxied - Access DNS settings at `dash.cloudflare.com/?to=/:account/:zone/dns` ### SSL/TLS configuration - Set encryption mode to “Full (strict)” - Access SSL/TLS settings at `dash.cloudflare.com/?to=/:account/:zone/ssl-tls` > ⚠ Incorrect SSL/TLS configuration may cause redirect loops ### Caching configuration - Set caching level to “Standard” - Access caching settings at `dash.cloudflare.com/?to=/:account/:zone/caching/configuration` ### Cache rules Cloudflare has deprecated Page Rules in favor of their modern [Rules](https://developers.cloudflare.com/rules/) system. Create the following using **Cache Rules** at `dash.cloudflare.com/?to=/:account/:zone/rules`: - Set Cache Level to “Bypass” for `community.example.com/session/*` - Configure URL normalization settings to normalize incoming URLs ### Network settings The network settings at `dash.cloudflare.com/?to=/:account/:zone/network` generally do not affect Discourse functionality. Discourse does not use WebSockets, gRPC, or the `CF-IPCountry` / `True-Client-IP` headers. These settings can be left at their defaults unless other software on the same domain requires specific configuration. ### WAF (Web Application Firewall) settings If your Cloudflare plan supports Managed Rules, create the following: 1. Skip WAF on post creation/edits: ```ruby (starts_with(http.request.uri.path, "/posts") and http.request.method in {"POST" "PUT"}) ``` 1. For [Data Explorer](https://meta.discourse.org/t/32566?silent=true) plugin users, skip WAF on admin queries: ```ruby ((http.request.uri.path contains "/admin/plugins/explorer/queries/" or http.request.uri.path contains "/admin/plugins/discourse-data-explorer/queries/") and http.request.method eq "PUT") ``` For both rules: - Choose “Skip all remaining rules” - Enable “Log matching requests” > ℹ If you are on a Business plan or above, you can use the `matches` regex operator for more precise matching. The `starts_with` and `contains` operators used above work on all plans including Free and Pro. Access WAF settings at `dash.cloudflare.com/?to=/:account/:zone/firewall/managed-rules` ### Content optimization Configure the following at `dash.cloudflare.com/?to=/:account/:zone/speed/optimization`: - Enable Brotli - Disable Rocket Loader™ > ⚠ Discourse frequently receives site down reports [due to Rocket Loader™ being enabled](https://meta.discourse.org/search?q=rocket%20loader%20order%3Alatest) ## Additional configuration for self-hosted installations To ensure correct IP address forwarding, add the following to the templates section in your `containers/app.yml`: ```yaml - "templates/cloudflare.template.yml" ``` > ⚠ After adding the template, you must rebuild your container with `./launcher rebuild app` for the changes to take effect. Related: [How do you setup Cloudflare?](https://meta.discourse.org/t/how-do-you-setup-cloudflare/32258/6) ## Support resources - [Cloudflare Community Support](https://community.cloudflare.com/t/using-discourse-with-cloudflare-best-practices/602890) - [Search Discourse Meta for Cloudflare-related issues](https://meta.discourse.org/search?q=cloudflare) ## Troubleshooting ### Content Security Policy (CSP) issues If you encounter CSP errors: - Verify that Rocket Loader is disabled - Check that scripts are properly added to the `content security policy script src` site setting ### OneBox functionality If OneBox is being blocked: - Check if Super Bot Fight Mode is enabled - Adjust the “Definitely automated” setting if it’s set to “Managed” or “Block” - Consider creating a custom WAF rule for the OneBox user agent > [@Discourse](#): > > ## Special Thanks to… > > @tcloonan for authoring this topic 👏🏻 > Last edited by @nat 2025-05-06T09:48:57Z > > > **Check document** > > > > Perform check on document: --- _[View the full topic](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405)._