this post was submitted on 09 Jan 2024
40 points (95.5% liked)

Selfhosted

40438 readers
444 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
40
What's wrong with using cloudflared? (lemmy.world)
submitted 10 months ago by damnthefilibuster@lemmy.world to c/selfhosted@lemmy.world
39 comments fedilink hide all child comments
 

I read a comment on here some time ago where the person said they were using cloudflared to expose some of their self-hosted stuff to the Internet so they can access it remotely.

I am currently using it to expose my RSS feed reader, and it works out fine. I also like the simplicity of Cloudflare's other offerings.

Any thoughts on why cloudflared is not a good idea? What alternatives would you suggest? How easy/difficult are they to setup?

you are viewing a single comment's thread
view the rest of the comments
[–] Dave@lemmy.nz 70 points 10 months ago (10 children)

I think concerns come in two flavours:

  1. Privacy/security: Cloudflare terminates HTTPS, which means they decrypt your data on their side (e.g. browser to cloudflare section) then re-encrypt for the second part (cloudflare to server). They can therefore read your traffic, including passwords. Depending on your threat model, this might be a concern or it might not. A counterpoint is that Cloudflare helps protect your service from bad actors, so it could be seen to increase security.
  2. Cloudflare is centralised. The sidebar of this community states "A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.", and Cloudflare is for sure a service you don't control, and arguably you're locked into it if you can't access your stuff without it. Some people think Coudflare goes against the ethos of self-hosting.

With that said, you'll find several large lemmy instances (and many small ones) use cloudflare. While you'll easily find people against its use, you'll find many more people in the self-hosted community using it because it's (typically) free and it works. If you want to use it, and you're ok with the above, then go ahead.

[–] JonnyJaap@lemmy.world 2 points 10 months ago (1 children)

The first point is only when you use the tunnel function, right ?

Because I noticed, if use the tunnel function (hiding your private ip) the sites gets an Cloudflare certificate, but if just using it as DNS (without tunnel) the page has my certificate.

[–] Dave@lemmy.nz 3 points 10 months ago

If you use DNS with proxy it still applies, you should get a Cloudflare certificate then. But yes, if you use Cloudflare as DNS only, then it should be direct. I believe you get none of the protection or benefits doing this, you're just using them as a name server.

The Cloudflare benefits of bot detection, image caching, and other features all rely on the proxy setting.

Also if proxying is enabled, your server IP is hidden which helps stop people knowing how to attack your server (e.g. they won't have an IP address to attempt to SSH into it). You don't get this protection in DNS only mode either.

Basically if you're using DNS only, it's no different to using the name server from your domain registrar as far as I can tell.

load more comments (8 replies)