Cloudflare Developers•3y ago

https://www.cloudflarestatus.com/incidents/x3xyb1gqf0dy/

Elevated 5xx/499s errors

EErisa https://www.cloudflarestatus.com/incidents/x3xyb1gqf0dy/

Bjarn•8/28/23, 7:07 PM

Hero! Thanks

chientrm.com•8/28/23, 7:09 PM

cf cosplay Github

ErisaOP•8/28/23, 9:30 PM

You need a backend

ErisaOP•8/28/23, 9:31 PM

even if that backend is a Worker

ErisaOP•8/28/23, 9:39 PM

Does the action send a request to a backend..?

ErisaOP•8/28/23, 9:41 PM

Okay

ErisaOP•8/28/23, 9:41 PM

So you will need to proxy the request to the external API with a Worker, and have the Worker also verify the turnstile response. Then it will work

ErisaOP•8/28/23, 9:42 PM

There is some examples here https://developers.cloudflare.com/turnstile/get-started/server-side-validation/

ErisaOP•8/28/23, 9:42 PM

In this part you would run your external API call

Frerduro•8/29/23, 1:58 AM

How long does it take for cloudflare to start caching files? server transmit is peaking up to 4gbps and I dont see cloudflare caching.

Frerduro•8/29/23, 1:59 AM

Frerduro•8/29/23, 1:59 AM

the file is in the list of cached files by cloudflare

Isaac McFadyen•8/29/23, 2:00 AM

It should be pretty quick - but make sure that users are actually hitting Cloudflare, not your server directly.

Isaac McFadyen•8/29/23, 2:00 AM

See the graph above which should have a bandwidth number

Isaac McFadyen•8/29/23, 2:00 AM

Also you can check the Cf-Cache-Status header which should say HIT not DYNAMIC - if it's DYNAMIC then Cloudflare is intentionally not caching for some reason

Frerduro•8/29/23, 2:00 AM

We are using zero trust tunnel. and firewall is locked down it can't be access externally

IIsaac McFadyen See the graph above which should have a bandwidth number

Frerduro•8/29/23, 2:02 AM

IIsaac McFadyen Also you can check the Cf-Cache-Status header which should say HIT not DYNAMIC -...

Frerduro•8/29/23, 2:02 AM

I dont know how to do that.

FFrerduro I dont know how to do that.

Isaac McFadyen•8/29/23, 2:04 AM

If you give us a URL we can check, or I can show you how.

IIsaac McFadyen If you give us a URL we can check, or I can show you how.

Frerduro•8/29/23, 2:04 AM

sent in dms

FFrerduro sent in dms

Isaac McFadyen•8/29/23, 2:06 AM

That's odd. I'm seeing a continual MISS (not DYNAMIC) which shouldn't be happening, really, since I'm hitting the same colo. One sec.

IIsaac McFadyen That's odd. I'm seeing a continual MISS (not DYNAMIC) which shouldn't be happeni...

Isaac McFadyen•8/29/23, 2:07 AM

Solved in DMs - the file was too large to cache on your plan.

ZZnuff With any of CF's products (except maybe a worker?) there is no way to rewrite a ...

Isaac McFadyen•8/29/23, 2:08 AM

You could with a Worker yes, but keep in mind POST and GET are different for a reason. GET can have bodies but isn't supposed to and some reverse proxies will strip it if they see it. GET can also be cached and POST shouldn't be (which matters for things like form submissions).

Isaac McFadyen•8/29/23, 2:09 AM

But if you understand the risks then yeah, a Worker could do it.

Daniel Sincere•8/29/23, 3:26 AM

if I create a Cloudflare tunnel using Terraform, how do I get an origin cert that I can upload to a Kubernetes cluster? When using

cloudflared

cloudflared

on the command line, the

create

create

command creates the

.pem

.pem

Daniel Sincere•8/29/23, 3:51 AM

Would be nice to have a 100% terraform solution. For now, I'm using

cloudflared login

cloudflared login

to create a cert.

DDaniel Sincere if I create a Cloudflare tunnel using Terraform, how do I get an origin cert tha...

Kasumi•8/29/23, 4:17 AM

Just Google it or create a origin certificate in the SSL tab

Kasumi•8/29/23, 8:15 AM

How can I fix this. And yes it uses the CF origin certificate

TTraffy I want to verify that all non-cache traffic coming to my origin is via cloudflar...

Hello, I’m Allie!•8/29/23, 8:50 AM

Enable Access in Bypass, then Verify the JWT

Validate JWTs · Cloudflare Zero Trust docs

When Cloudflare sends a request to your origin, the request will include an application token as a Cf-Access-Jwt-Assertion request header and as a …

Hello, I’m Allie!•8/29/23, 8:51 AM

If you use CF Tunnels, it can do so for you automatically

TTraffy If I block external port 80 and install CF tunnel and connect it with internal p...

Hello, I’m Allie!•8/29/23, 10:02 AM

Yes, and yes. Note too that depending on how complex your

nginx

nginx

config is, Tunnel might be able to replace it entirely.

TTraffy My nginx is super simple ``` server { listen 80; server_name domain.xyz www....

Hello, I’m Allie!•8/29/23, 10:14 AM

Would the backend accept only the

X-Forwarded-For

X-Forwarded-For

Hello, I’m Allie!•8/29/23, 10:14 AM

Looks like Tunnel doesn't add

X-Real-IP

X-Real-IP

TTraffy Here's my updated config: ``` location / { proxy_pass http://localhost:3000...

Hello, I’m Allie!•8/29/23, 10:22 AM

Should work fine then. You should just be able to use a single Tunnel, without

nginx

nginx

TTraffy Awesome. So should I just add my backend in

Hello, I’m Allie!•8/29/23, 10:29 AM

Yes, then add the JWT to the Tunnel for it to be verified.

TTraffy One more thing. Lets say my origin server is in Germany then by using tunnel wil...

Hello, I’m Allie!•8/29/23, 10:36 AM

The Tunnel itself would connect to datacenters in and around Germany. From there, data could be routed from an Indian datacenter to the ones in Germany.

Kasumi•8/29/23, 12:29 PM

Ig caching just needs some time.

Kasumi•8/29/23, 12:38 PM

But I like this peak lol

https://www.cloudflarestatus.com/incidents/x3xyb1gqf0dy/

Similar Threads

Similar Threads

Similar Threads