{"id":1964,"date":"2021-04-20T01:32:15","date_gmt":"2021-04-20T01:32:15","guid":{"rendered":"https:\/\/dft.wiki\/?p=1964"},"modified":"2026-06-08T22:53:05","modified_gmt":"2026-06-09T02:53:05","slug":"setting-up-a-content-delivery-network-cdn-with-cloudflare","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=1964","title":{"rendered":"Setting Up a Content Delivery Network (CDN) with Cloudflare"},"content":{"rendered":"

A CDN<\/strong> is a group of servers distributed around the world. It improves your website’s speed by caching content in multiple locations, reducing the load on the origin server and handling traffic peaks.<\/p>\n

Many CDNs include a WAF<\/strong> (Web Application Firewall) and protection against DDoS<\/strong> (Distributed Denial of Service) attacks. The IP address of the origin server is never exposed.<\/p>\n

Cloudflare<\/strong> offers a free plan with DNS<\/strong> hosting, CDN<\/strong>, WAF<\/strong>, and API<\/strong> access. It also includes Tunnel<\/strong> (for securely exposing services) and SSO<\/strong> (Single Sign-On).<\/p>\n

A open-source alternative similar to Cloudflare Tunnel and SSO (but without CDN or WAF) is Pangolin<\/strong> [Link<\/a>]. It uses WireGuard<\/strong> for tunneling and Traefik<\/strong> for reverse proxy and certificate management.<\/p>\n

Back to Cloudflare…<\/p>\n

\n

SETTING UP FREE DNS SERVICE<\/strong><\/p>\n

Create an account and add your first site (domain):<\/p>\n

\"\"<\/p>\n

Select the free option:<\/p>\n

\"\"<\/p>\n

Cloudflare will automatically detect your existing DNS records:<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

Note:<\/strong> Two records have warnings on the left. These records expose your server’s IP address and should be removed. Delete these two lines to hide your web server!<\/strong><\/p>\n

Cloudflare will then show you the new nameservers to set at your domain registrar:<\/p>\n

\"\"<\/p>\n

Point your domain to the Cloudflare nameservers:<\/p>\n

\"\"<\/p>\n

Answer a few questions about basic features:<\/p>\n

\"\" \"\" \"\" \"\"<\/p>\n

Setup completes after a few hours once the new nameservers propagate across the Internet:<\/p>\n

\"\"<\/p>\n

\n

ENABLING SSL\/TLS WILDCARD<\/strong><\/p>\n

\"\"<\/p>\n

On the SSL\/TLS tab, select Flexible for now:<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

A wildcard certificate hides your subdomains (any old certificates will eventually expire):<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

Copy the private and public keys to a safe location.<\/strong><\/p>\n

Change the mode to Full or Full (strict):<\/p>\n

\"\"<\/p>\n

Your site may go offline until you install the certificates on your origin server.<\/p>\n

\n

INSTALL ORIGIN CERTIFICATE ON THE SERVER<\/strong><\/p>\n

Create the directory \/etc\/cloudflare\/<\/strong> and save the following files using the keys you copied earlier:<\/p>\n

\/etc\/cloudflare\/example.com.pem<\/strong><\/p>\n

-----BEGIN CERTIFICATE-----<\/strong>\r\n...\r\n-----END CERTIFICATE-----<\/strong><\/pre>\n
\/etc\/cloudflare\/example.com.key<\/strong><\/p>\n
-----BEGIN PRIVATE KEY-----<\/strong>\r\n...\r\n-----END PRIVATE KEY-----<\/strong><\/pre>\n
For NGINX<\/strong>, edit \/etc\/nginx\/sites-available\/default<\/strong> and add:<\/p>\n
server {\r\n   listen                443;\r\n   ssl                   on;\r\n   ssl_certificate       \/etc\/cloudflare\/example.com.pem;\r\n   ssl_certificate_key   \/etc\/cloudflare\/example.com.key;<\/strong>\r\n\r\n   server_name           example.ca;\r\n   access_log            \/var\/log\/nginx\/nginx.vhost.access.log;\r\n   error_log             \/var\/log\/nginx\/nginx.vhost.error.log;\r\n\r\n   root                  \/var\/www\/html\/;\r\n   index                 index.php index.html;\r\n\r\n   location ~ \\.php$ {\r\n      include            snippets\/fastcgi-php.conf;\r\n      fastcgi_pass       unix:\/var\/run\/php\/php7.4-fpm.sock;\r\n   }\r\n}<\/pre>\n
For Apache2<\/strong>, edit \/etc\/apache2\/sites-available\/000-default.conf<\/strong> and add:<\/p>\n
<VirtualHost *:443>\r\n   SSLEngine                on\r\n   SSLCertificateFile       \/etc\/cloudflare\/example.com.pem\r\n   SSLCertificateKeyFile    \/etc\/cloudflare\/example.com.key\r\n   SSLCertificateChainFile  \/etc\/cloudflare\/ca.pem<\/span><\/strong>\r\n\r\n   ServerAdmin              admin@example.com\r\n   DocumentRoot             \/var\/www\/html\r\n   ServerName               example.com\r\n   ServerAlias              www.example.com\r\n   ErrorLog                 ${APACHE_LOG_DIR}\/error.log\r\n   CustomLog                ${APACHE_LOG_DIR}\/access.log combined\r\n<\/VirtualHost><\/pre>\n
After editing the web server config, restart the service.<\/p>\n
For Apache2, make sure the SSL module is enabled before restarting:<\/p>\n
sudo a2enmod ssl<\/pre>\n
The red line in the Apache configuration is optional and only needed in some setups. The CA file can be found in the Cloudflare help center.<\/p>\n
Set permissions to 600 on all certificate files:<\/p>\n
sudo chmod 600 \/etc\/cloudflare\/*<\/pre>\n
You can now block port 80 on your server, since Cloudflare will automatically redirect all HTTP traffic to HTTPS.<\/p>\n
\n
Did you know you can use Cloudflare as Dynamic DNS for a website hosted on a Raspberry Pi?<\/p>\n
Yes! Using the API, you can automate updates whenever your IP address changes:<\/p>\n
git clone https:\/\/github.com\/K0p1-Git\/cloudflare-ddns-updater.git\r\ncd cloudflare-ddns-updater\r\ncp cloudflare-template.sh cloudflare.sh\r\nnano cloudflare.sh<\/pre>\n
Customize the following variables at the top of the script:<\/p>\n
auth_email=\"myemail@gmail.com<\/strong>\"\r\nauth_key=\"c7d36f12f8c9189f053ca39e90e859eaa77b1<\/strong>\"\r\nzone_identifier=\"542818cd0a64a3b2b96ef8859c6ddac0<\/strong>\"\r\nrecord_name=\"myhome.mydomain.com<\/strong>\"<\/pre>\n
Replace the values in bold<\/strong> with your own, make the file executable, and run it:<\/p>\n
chmod +x cloudflare.sh\r\n.\/cloudflare.sh<\/pre>\n
If your domain or subdomain updates successfully, add the following line to crontab (crontab -e<\/code>):<\/p>\n
* * * * * \/path<\/strong>\/cloudflare.sh > \/dev\/null 2>&1<\/pre>\n
\n
BONUS<\/strong><\/p>\n
Take a look at AI Labyrinth, a new tool designed to combat web-crawling bots that harvest content for AI training without consent. This free, opt-in solution detects suspicious bot activity and leads them through a maze of AI-generated decoy pages, wasting their time and resources.<\/p>\n
\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
A CDN is a group of servers distributed around the world. It improves your website’s […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-1964","post","type-post","status-publish","format-standard","hentry","category-web"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1964"}],"version-history":[{"count":15,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1964\/revisions"}],"predecessor-version":[{"id":5737,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1964\/revisions\/5737"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}