If you can serve content locally without tunnel (ie no CGNAT or port block by ISP), you can configure your server to respond only to cloudflare IP range and your intranet IP range; slap on the Cloudflare origin cert for your domain, and trust it for local traffic; enable orange cloud; and tada. Access from anywhere without VPN; externally encrypted between user <> cloudflare and cloudflare <> your service; internally encrypted between user <> service; and only internally, or someone via cloudflare can access it. You can still put the zero trust SSO on your subdomain so Cloudflare authenticates all users before proxying the actual request.
this post was submitted on 02 Feb 2025
21 points (92.0% liked)
Selfhosted
41674 readers
640 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
This worked great. For those looking to apply the same solution. And running Nextcloud in snap. You need a cert.pem, key.pem and chain.pem file. The latter can be found here: https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/#cloudflare-origin-ca-root-certificate The cert and key can be generated from your Cloudflare Dashboard under Domains > SSL/TLS > Edge Certificate.
Place all three files in /var/snap/nextcloud/12345/certs/live/ where 12345 can vary for you.
Finally
sudo nextcloud.enable-https custom cert.pem key.pem chain.pem
Profit!
Maybe you can use letsencrypt's DNS-01 challenge. That works without an HTTP connection. But ultimately, I don't think you need a certificate on the server, doesn't Cloudflare tunnel the traffic (unencrypted) and terminate the HTTPS on their side?
It can be unencrypted, but isn’t a requirement.
Thanks for the reply, among all answers I chose this. Just because it works for me.
Behind a cloudflare tunnel you can use a self signed or expired certificate, just check the "no TLS verify" checkbox
Edit: or use DNS based verification, nginx proxy manager can do it automatically using cloudflare api when behind cloudflare tunnels
Thanks for the reply, among all answers I chose this. Just because it works for me.
Are you a bot?
Would a bot tell you? 🧐
No posts/c9mments in like a year and a half, then this... I'd guess yes.
3 people independently advice dns challenge. They all deserve the same appreciation don't they?
I don't think a copy/paste answer comes across as appreciation, no.
It comes across weird, especially on a low activity account, and seems like a bot response that got stuck.
I'm just a passive observer and it's fine. You can assume it's a bot but that's not on them. They seem legitimate and my assumption is maybe English isn't their first language.
With the other comments since, yeah not a bot. Early on with the long gap, then a post and the same commen t being the only comment - yeah that looks like a bot.
Its not an indictment of them, just observation.
DNS-01 challenge with letsencrypt. Or use cloudflare tunnel and don't use https internally.
Thanks for the reply, among all answers I chose this. Just because it works for me.
Setup a cron that does it once per day, when you don't need it, like certbot does. Easy.