Usage with Cloudflare proxy #238

bollerdominik · 2020-12-17T12:23:17Z

In my env file I define my IP to the public IP of the server.
I can run a docker container and I can access it from the specified domain with HTTPS and a valid Lets-Encrypt certificate.

Now I switch my Cloudflare toggle to proxy all requests to my webserver. This results in a "This page isn't redirecting properly" error and I can no longer access the docker container.

I would like to know how to setup Cloudflare and this proxy to properly work together.

Example container:

version: '3.2'
services:
  grafana:
    image: grafana/grafana
    container_name: grafana
    hostname: grafana
    expose:
      - "3000"
    environment:
      VIRTUAL_HOST: graf.domain.com
      LETSENCRYPT_HOST: graf.domain.com

networks:
  default:
    external:
      name: webproxy

The text was updated successfully, but these errors were encountered:

evertramos · 2020-12-18T13:00:22Z

Using cloudflare the letsencrypt certificates will not be renewed unless you bypass the cloudflare proxy. You could disable the letsencrypt removing the LETSENCRYPT_HOST option and uncomment the USE_NGINX_CONF_FILES in your .env file. It will add the cloudflare real ip forwarding to you container in case you need it.

evertramos · 2020-12-18T13:01:49Z

I have a script that will open source it soon, just waiting the sponsor to validate which disable the proxy update the ssl and activate the proxy again, doing automatically using cron, but might take a while to post it.

bollerdominik · 2020-12-18T13:06:18Z

I am aware of this limitation that I can not renew the lets encrypt certificates while behind the cloudflare proxy. This is not ideal but I can work around this.

However, my issue seems to be different. I have a valid lets encrypt cert but can not use it along with grafana, this proxy and cloudflare. I get the "This page isn't redirecting properly" on my browser. Same thing happening with a MinIO docker container.

Do you have any suggestion for this issue?

Thank you for your work on this great script.

evertramos · 2020-12-18T13:27:21Z

it works if you bypass the proxy but it does if you activate the proxy is that what's happening? I had this issue when starting to work with cloudflare... I will try to remember but think it was a cloudflare config for that matter.

evertramos · 2020-12-18T13:27:48Z

what the log says in proxy and grafana container?

bollerdominik · 2020-12-18T13:48:22Z

If I do not use the Cloudflare proxy it works. I can make a https request with a valid lets encrypt certification.

If I activate the Cloudflare proxy I get "This page isn't redirecting properly" in my browser.

The nginx-proxy logs

nginx-web            | graf.domain.com 162.XXX.XXX.55 - - [18/Dec/2020:13:44:17 +0000] "GET /?orgId=1 HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"
nginx-web            | graf.domain.com 162.XXX.XXX.55 - - [18/Dec/2020:13:44:17 +0000] "GET /?orgId=1 HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"
nginx-web            | graf.domain.com 162.XXX.XXX.55 - - [18/Dec/2020:13:44:17 +0000] "GET /?orgId=1 HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"
nginx-web            | graf.domain.com 162.XXX.XXX.55 - - [18/Dec/2020:13:44:17 +0000] "GET /?orgId=1 HTTP/1.1" 301 169 "-" 
.....many more redirects....

The grafana docker container logs do not show any requests. It usually logs all http requests so I assume the calls do not reach the grafana container.

evertramos · 2020-12-18T14:07:13Z

This is more related to the CloudFlare configuration than this proxy. Check the page rules and the tls options...

bollerdominik · 2020-12-18T16:35:57Z

I have pretty much tried every SSL related page rule. Even disabling SSL It is always the same unfortunately.

bollerdominik · 2020-12-18T16:41:42Z

Disabling LETSENCRYPT_HOST on the docker container makes it work again. It just unfortunate that it seems I can not use Lets Encrypt to encrypt the traffic from Cloudflare to my server

evertramos · 2020-12-19T10:56:56Z

I will try to check on that and see how to use both!

bollerdominik · 2021-01-22T15:40:37Z

Hi just asking if you have been able to check on this. I have been trying some custom nginx configs to stop the infinite redirects but did not have any luck.

I would love to be able to use Cloudflare with its DDOS protection and this useful nginx proxy.

I tried the minio, grafana and docker-elk. All end up with infinite redirects from nginx-web as soon as I toggle the Cloudflare proxy

NanoCode012 · 2021-03-13T11:46:16Z

Hello, I would like to share my own experience. I used to get these infinite redirects too. After much fiddling, I got it to work.

I did this for both the previous version (0.4) and the one that just came out yesterday (v2).

My setup on Cloudflare:

set SSL/TLS encryption mode: Full
turn off Always Use HTTPS from the SSL/TSL > Edge Certificates
under Page Rules, add page rule with URL: *hostname.tld/.well-known/acme-challenge/* and set Disabled Security , SSL: Off, Cache level: Bypass, Automatic Rewrites: Off

With the latest version, just run the fresh_install.sh, and it just works!

Note: Make sure to add the DNS for A record and set it to Proxied (Orange Cloud).

surister · 2021-11-16T08:43:44Z

Hello, I would like to share my own experience. I used to get these infinite redirects too. After much fiddling, I got it to work.

I did this for both the previous version (0.4) and the one that just came out yesterday (v2).

My setup on Cloudflare:
* set `SSL/TLS encryption mode: Full`

* turn off `Always Use HTTPS` from the `SSL/TSL > Edge Certificates`

* under `Page Rules`, add page rule with URL: `*hostname.tld/.well-known/acme-challenge/*` and set `Disabled Security` , `SSL: Off`, `Cache level: Bypass`, `Automatic Rewrites: Off`
With the latest version, just run the fresh_install.sh, and it just works!

Note: Make sure to add the DNS for A record and set it to Proxied (Orange Cloud).

With SSL/TLS encryption mode:Full I wasn't able to achieve it, I'd get self signed certificate errors but setting it to SSL/TLS encryption mode: Full(strict) made the trick.

adrianharabula · 2022-01-02T00:12:07Z

Hello, I would like to share my own experience. I used to get these infinite redirects too. After much fiddling, I got it to work.

I did this for both the previous version (0.4) and the one that just came out yesterday (v2).

My setup on Cloudflare:
* set `SSL/TLS encryption mode: Full`

* turn off `Always Use HTTPS` from the `SSL/TSL > Edge Certificates`

* under `Page Rules`, add page rule with URL: `*hostname.tld/.well-known/acme-challenge/*` and set `Disabled Security` , `SSL: Off`, `Cache level: Bypass`, `Automatic Rewrites: Off`
With the latest version, just run the fresh_install.sh, and it just works!

Note: Make sure to add the DNS for A record and set it to Proxied (Orange Cloud).

It works!! Thank you very much!!!

Now nextcloud container, does not see original client IP, it sees the Cloudflare IP as connected client. I have added Cloudflare IP's to trusted proxies, but they have no effect:

  'trusted_proxies' => 
  array (
    0 => '10.42.0.0/16',
    1 => '103.21.244.0/22',
    2 => '103.22.200.0/22',
    3 => '103.31.4.0/22',
    4 => '104.16.0.0/12',
    5 => '108.162.192.0/18',
    6 => '131.0.72.0/22',
    7 => '141.101.64.0/18',
    8 => '162.158.0.0/15',
    9 => '172.64.0.0/13',
    10 => '173.245.48.0/20',
    11 => '188.114.96.0/20',
    12 => '190.93.240.0/20',
    13 => '197.234.240.0/22',
    14 => '198.41.128.0/17',
    15 => '2400:cb00::/32',
    16 => '2606:4700::/32',
    17 => '2803:f800::/32',
    18 => '2405:b500::/32',
    19 => '2405:8100::/32',
    20 => '2c0f:f248::/32',
  ),

Not sure if there is a solution for this, but I would like to find one.

adrianharabula · 2022-01-02T01:00:35Z

Oh, I had to put USE_NGINX_CONF_FILES=true in .env and re-run fresh-start.sh. Now I get real IP in the nextcloud container. No trusted proxy needed in nextcloud config files.

evertramos · 2022-01-03T13:32:13Z

@adrianharabula when you set true to use nginx conf files it will activate this configurations:

https://github.com/evertramos/nginx-proxy-automation/blob/master/conf.d/realip.conf

anteqkois · 2023-10-12T10:56:59Z

Hello, I would like to share my own experience. I used to get these infinite redirects too. After much fiddling, I got it to work.

I did this for both the previous version (0.4) and the one that just came out yesterday (v2).

My setup on Cloudflare:

set SSL/TLS encryption mode: Full

turn off Always Use HTTPS from the SSL/TSL > Edge Certificates

under Page Rules, add page rule with URL: *hostname.tld/.well-known/acme-challenge/* and set Disabled Security , SSL: Off, Cache level: Bypass, Automatic Rewrites: Off

With the latest version, just run the fresh_install.sh, and it just works!

Note: Make sure to add the DNS for A record and set it to Proxied (Orange Cloud).

I can't do this. I tried using docker compose:

version: "3"
services:
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:latest
    environment:
      - VIRTUAL_HOST=xyz
      - LETSENCRYPT_HOST=xyz
      - VIRTUAL_PORT=8080
      - LETSENCRYPT_EMAIL=xyz
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - 8080:8080

networks:
  default:
    external:
      name: ${NETWORK:-proxy}

But I still get 500 from nginx. I know that it work before, because other devs used this way, but I don't know why it stop working

evertramos added the enhancement label Dec 19, 2020

evertramos changed the title ~~Useage with Cloudflare proxy~~ Usage with Cloudflare proxy Mar 12, 2021

evertramos pinned this issue Mar 30, 2021

evertramos closed this as completed Mar 30, 2021

NanoCode012 mentioned this issue Apr 6, 2021

Too many redirects when adding nginx-proxy-letsencrypt container nginx-proxy/acme-companion#762

Closed

evertramos mentioned this issue Jul 15, 2021

Usage with Cloudflare Tunnels #302

Closed

surister mentioned this issue Nov 16, 2021

[BUG] Composed Subdomains from Cloudfare emit SSL_ERROR_NO_CYPHER_OVERLAP #335

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Usage with Cloudflare proxy #238

Usage with Cloudflare proxy #238

bollerdominik commented Dec 17, 2020 •

edited

Loading

evertramos commented Dec 18, 2020

evertramos commented Dec 18, 2020

bollerdominik commented Dec 18, 2020

evertramos commented Dec 18, 2020

evertramos commented Dec 18, 2020

bollerdominik commented Dec 18, 2020

evertramos commented Dec 18, 2020

bollerdominik commented Dec 18, 2020

bollerdominik commented Dec 18, 2020

evertramos commented Dec 19, 2020

bollerdominik commented Jan 22, 2021 •

edited

Loading

NanoCode012 commented Mar 13, 2021

surister commented Nov 16, 2021 •

edited

Loading

adrianharabula commented Jan 2, 2022

adrianharabula commented Jan 2, 2022

evertramos commented Jan 3, 2022

anteqkois commented Oct 12, 2023

Usage with Cloudflare proxy #238

Usage with Cloudflare proxy #238

Comments

bollerdominik commented Dec 17, 2020 • edited Loading

evertramos commented Dec 18, 2020

evertramos commented Dec 18, 2020

bollerdominik commented Dec 18, 2020

evertramos commented Dec 18, 2020

evertramos commented Dec 18, 2020

bollerdominik commented Dec 18, 2020

evertramos commented Dec 18, 2020

bollerdominik commented Dec 18, 2020

bollerdominik commented Dec 18, 2020

evertramos commented Dec 19, 2020

bollerdominik commented Jan 22, 2021 • edited Loading

NanoCode012 commented Mar 13, 2021

surister commented Nov 16, 2021 • edited Loading

adrianharabula commented Jan 2, 2022

adrianharabula commented Jan 2, 2022

evertramos commented Jan 3, 2022

anteqkois commented Oct 12, 2023

bollerdominik commented Dec 17, 2020 •

edited

Loading

bollerdominik commented Jan 22, 2021 •

edited

Loading

surister commented Nov 16, 2021 •

edited

Loading