Cloudflare Developers•15mo ago

Is mTLS between two workers possible?

Llaurmat Is mTLS between two workers possible?

Hello, I’m Allie!•9/28/24, 4:32 PM

On the same account?

HHello, I’m Allie!On the same account?

laurmatOP•9/28/24, 5:18 PM

Same account or even 2 different accounts. I’m asking because I tried this guide - https://developers.cloudflare.com/workers/runtime-apis/bindings/mtls/ but couldn’t make it work. Am I missing something?

Cloudflare Docs

mTLS | Cloudflare Workers docs

Configure your Worker to present a client certificate to services that enforce an mTLS connection.

Llaurmat Same account or even 2 different accounts. I’m asking because I tried this guide...

Hello, I’m Allie!•9/28/24, 6:45 PM

For same account, I don’t see why you would need it, since no one else can create bindings on your behalf

Hello, I’m Allie!•9/28/24, 6:45 PM

Or at least, if they can, you have bigger things to worry about

user•9/28/24, 7:32 PM

Is billable usage erroring for anyone else?

HHello, I’m Allie!For same account, I don’t see why you would need it, since no one else can creat...

laurmatOP•9/28/24, 8:27 PM

The goal is to block transparent proxy tools like Charles proxy, Reqable, etc to see my worker’s requests. So my flow is like this: worker1 has the main logic, when it is accessed, it fetch worker2 and worker2 will check if the mTLS certificate is validated. If it is, the flow will continue with the main logic on worker1, otherwise it will block the connection.

Llaurmat The goal is to block transparent proxy tools like Charles proxy, Reqable, etc to...

Hello, I’m Allie!•9/28/24, 8:33 PM

I meant, you could just disable inbound connections for Worker2?

Hello, I’m Allie!•9/28/24, 8:33 PM

That should stop anyone from accessing it via a proxy

Hello, I’m Allie!•9/28/24, 8:34 PM

At least for same-account

HHello, I’m Allie!I meant, you could just disable inbound connections for Worker2?

laurmatOP•9/28/24, 8:37 PM

Do you mind if I DM you a few questions?

Paul•9/28/24, 10:05 PM

Has anyone tried to use dependency injection and decorators with cf workers? My initial attempt doesn’t seem to work because the di container system generates random keys outside the scope of the worker. I’m using tsyringe in this case but I think it applies to all di container systems

Socal•9/29/24, 2:12 AM

Does anyone know of a good way to handle secrets management in workers? Let's say I onboard a client for a saas and the workers now need to be aware of a new client secret.

What is the best way to handle that instead of manually going into the cloudflare worker and adding it as an environment variable secret?

If I have one worker for secret management, how will I let the other pertinent workers know of the new secret?

RRicky U Does Workers now support native Mongodb driver? https://blog.cloudflare.com/mor...

Ru Chern Chong•9/29/24, 3:21 AM

I am here for the same question too. It might actually be natively compatible now. I might do a quick POC to test this.

Jay•9/29/24, 5:39 AM

any reason a worker should be 530'ing w/ error code 1016 on basic fetch requests, at random

Jay•9/29/24, 5:39 AM

i cannot debug this

Jay•9/29/24, 5:40 AM

Randomly this fetch statement:

export async function getPlayerData(careerUrl) {
    const res = await fetch('https://<redacted>.fly.dev/career', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
            careerUrl: careerUrl,
        }),
    });

    const account = await res.json();

    return account;
}

export async function getPlayerData(careerUrl) {
    const res = await fetch('https://<redacted>.fly.dev/career', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
            careerUrl: careerUrl,
        }),
    });

    const account = await res.json();

    return account;
}

returns a 530 error code 1016.

other times it works perfectly. no clue whats happening

Jay•9/29/24, 5:41 AM

its not an issue with the server (api @ https://<redacted>.fly.dev/careerhttps://<redacted>.fly.dev/career) because I run the server itself (and if I manually make the exact same request it works every time) and its not even getting reached

got valid A record for everything too

Jay•9/29/24, 5:46 AM

also only started happening today -- this service has been running for months with no issue until right now with nothing changing

JJay Randomly this fetch statement: ```js export async function getPlayerData(career...

Isaac McFadyen•9/29/24, 6:05 AM

Fly.dev domains are anycast, meaning they're globally routed on Fly's backbone. I suspect that when you hit the server it works because you're entering the Fly network near your home, but when a Worker hits it it's entering in a different region that's having errors... that's really the only thing I can think of.

Isaac McFadyen•9/29/24, 6:05 AM

Hmmm but 1016 is DNS, so I'm not entirely sure.

Isaac McFadyen•9/29/24, 6:06 AM

If you throw your domain into https://www.whatsmydns.net/ and hit AA as record type, does it resolve everywhere?

DNS Propagation Checker - Global DNS Checker Tool

Instant DNS Propagation Check. Global DNS Propagation Checker - Check DNS records around the world.

Jay•9/29/24, 6:06 AM

yep

Jay•9/29/24, 6:06 AM

checks across the board

Jay•9/29/24, 6:06 AM

well, except 4 places

Jay•9/29/24, 6:06 AM

Isaac McFadyen•9/29/24, 6:07 AM

What colo are you hitting? https://cloudflare.com/cdn-cgi/trace and then the colocolo field should show you.

Jay•9/29/24, 6:07 AM

colo=AUScolo=AUS

Jay•9/29/24, 6:08 AM

unless you want me to hit that with the worker

Isaac McFadyen•9/29/24, 6:08 AM

And is the Austin Texas airport near-ish where you actually are? Just trying to rule out you getting routed to a non-nearby colo that's having DNS issues or something.

Jay•9/29/24, 6:08 AM

eh... near-ish yeah

Jay•9/29/24, 6:08 AM

like 3-4 hours off

Isaac McFadyen•9/29/24, 6:08 AM

Probably fine in regards to that then... hmm.

Jay•9/29/24, 6:09 AM

yeah its seemingly random too

Jay•9/29/24, 6:09 AM

i tried for like 30 minutes debugging... all errors
then randomly, successfully starts going through

Jay•9/29/24, 6:09 AM

rinse and repeat, will work and then not work

Isaac McFadyen•9/29/24, 6:10 AM

Hmm. Sorry I can't help more (and it's also quite late here so I'm about to head to bed)... if it's still happening tomorrow maybe some others will have ideas.

Jay•9/29/24, 6:11 AM

no problem, thanks for the responses!

Jay•9/29/24, 6:11 AM

im just hoping its some weird one-off thing i wont need to worry about

Fajhril•9/29/24, 10:55 AM

Fajhril•9/29/24, 10:56 AM

Hello, i want add my existing domain, with free services in cloudflare, but why the error seems like to pay the billing, anyone have a same problem like me?

FFajhril Hello, i want add my existing domain, with free services in cloudflare, but why ...

tadhglewis•9/29/24, 11:03 AM

What does it say when you go to https://dash.cloudflare.com/?to=/:account/billing ? Based on the error message, you have an outstanding invoice which is blocking you use from using free services until you pay.

Fajhril•9/29/24, 11:05 AM

yea i already checked my invoice, i always use that free services, there no one invoice i had except the free plan

Flare•9/29/24, 11:06 AM

Cloudflare's billing system is undergoing some changes/migration. During this period, you may notice extra bills, incorrect bills, or other issues.

To resolve these issues, create a Support ticket by using the following link (you must be logged into your Cloudflare account): https://dash.cloudflare.com/?to=/:account/support

Note that all accounts, even Free plan accounts, can create billing tickets. Tickets are the only way to resolve billing issues; we cannot help you in this Discord.