mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-02-08 05:56:45 +00:00
91 lines
2.5 KiB
Plaintext
91 lines
2.5 KiB
Plaintext
---
|
|
title: "Cloudflare Proxy"
|
|
---
|
|
|
|
Pangolin works with Cloudflare proxy (orange cloud) enabled, but requires specific configuration:
|
|
|
|
<Warning>
|
|
**Terms of Service**: Enabling Cloudflare proxy binds you to Cloudflare's terms of service as traffic routes through their network.
|
|
</Warning>
|
|
|
|
### SSL Configuration
|
|
|
|
**Recommended setup:**
|
|
1. **Use wildcard certificates** with DNS-01 challenge
|
|
2. **Set SSL/TLS mode to Full (Strict)**
|
|
3. **Disable port 80** (not needed with wildcard certs)
|
|
|
|
<Info>
|
|
Pangolin will **not work** with Cloudflare's Full or Automatic SSL/TLS modes. Only Full (Strict) mode is supported.
|
|
</Info>
|
|
|
|
### WireGuard Configuration
|
|
|
|
Since Cloudflare proxy obscures the destination IP, you must explicitly set your VPS IP in the [config file](/self-host/advanced/config-file):
|
|
|
|
```yaml
|
|
gerbil:
|
|
base_endpoint: "YOUR_VPS_IP_ADDRESS" # Required with Cloudflare proxy
|
|
```
|
|
|
|
<Steps>
|
|
<Step title="Get your VPS IP">
|
|
Find your VPS public IP address:
|
|
|
|
```bash
|
|
curl ifconfig.io
|
|
```
|
|
</Step>
|
|
|
|
<Step title="Update configuration">
|
|
Add the IP to your `config.yml`:
|
|
|
|
```yaml
|
|
gerbil:
|
|
base_endpoint: "104.21.16.1" # Replace with your actual IP
|
|
```
|
|
</Step>
|
|
|
|
<Step title="Restart services">
|
|
Restart Pangolin to apply the changes:
|
|
|
|
```bash
|
|
docker-compose restart
|
|
```
|
|
</Step>
|
|
</Steps>
|
|
|
|
### Getting the Real Client IP
|
|
|
|
Pangolin needs to know the original client IP address for features like rate limiting. When Cloudflare proxy is enabled, the API server sees Cloudflare's IP instead of the real client IP.
|
|
|
|
Cloudflare sets special headers with the real IP that need to be processed by Traefik before forwarding to Pangolin. Configure Traefik to parse these headers using a community plugin for Traefik: [Real IP from Cloudflare Proxy Tunnel](https://plugins.traefik.io/plugins/62e97498e2bf06d4675b9443/real-ip-from-cloudflare-proxy-tunnel).
|
|
|
|
Add the plugin to your Traefik configuration:
|
|
|
|
```yaml
|
|
experimental:
|
|
plugins:
|
|
cloudflarewarp:
|
|
moduleName: github.com/BetterCorp/cloudflarewarp
|
|
version: v1.3.0
|
|
|
|
entryPoints:
|
|
websecure:
|
|
address: ':443'
|
|
http:
|
|
middlewares:
|
|
- cloudflarewarp@file
|
|
```
|
|
|
|
This creates a middleware called `cloudflarewarp` and applies it to the `websecure` entrypoint.
|
|
|
|
Then set `trust_proxy: 2` in your Pangolin config file. This tells Pangolin to trust the second-level proxy (Traefik is proxy 1, Cloudflare is proxy 2):
|
|
1
|
|
```yaml
|
|
server:
|
|
trust_proxy: 2
|
|
```
|
|
|
|
After making these changes, restart both Traefik and Pangolin for the configuration to take effect.
|