Cloudflare Developers•15mo ago

looks like the _acme should pe placed by each tenant in their dns

CConstantin looks like the _acme should pe placed by each tenant in their dns

fry69•10/25/24, 5:25 PM

Correct, you need that CNAME for each domain.

ConstantinOP•10/25/24, 5:26 PM

right, so i was curious if i can buy sume cloudflare service to change the ...dcv.cloudflare.com with ...dcv.greatoutdoors-dns.live

ConstantinOP•10/25/24, 5:27 PM

so i can provide to my tenants

CConstantin right, so i was curious if i can buy sume cloudflare service to change the ...dc...

fry69•10/25/24, 5:27 PM

No. This will not work for above reason. Cloudflare needs control over this CNAME so it can answer ACME challenges or Cloudflare cannot setup TLS certificates for the domains, which are needed for the proxy front end.

ConstantinOP•10/25/24, 5:31 PM

well, for now i managed to make them work without placing the _acme TXT record. but i think the domain will not workanymore after the certificate will expire

ConstantinOP•10/25/24, 5:32 PM

so is needed for CF to reissue (automatically) a new certificate.

CConstantin so is needed for CF to reissue (automatically) a new certificate.

fry69•10/25/24, 5:32 PM

Correct.

fry69•10/25/24, 5:32 PM

Every three months.

ConstantinOP•10/25/24, 5:33 PM

can this process be tested somehow, without having to wait 3months?

ConstantinOP•10/25/24, 5:34 PM

or i should just trust that'll work

ConstantinOP•10/25/24, 5:34 PM

if the _txt record is there

CConstantin well, for now i managed to make them work without placing the _acme TXT record. ...

Chaika•10/25/24, 5:34 PM

You can just use http validation

Chaika•10/25/24, 5:34 PM

then no records needed at all other then the one normal cname for http

ConstantinOP•10/25/24, 5:35 PM

this one, of adding records, looks more professional, imho

Chaika•10/25/24, 5:35 PM

doing more work looks more professional?

Chaika•10/25/24, 5:36 PM

not sure I understand that but txts are a bit less possible to break

CConstantin right, so i was curious if i can buy sume cloudflare service to change the ...dc...

Chaika•10/25/24, 5:36 PM

I don't see any reason why you couldn't simply chain cnames, ex, you'd make <hostname>.dcv.yoursite.com unproxied cname to actual dcv.cloudflare.com. It wouldn't be very scalable though, you'd need a record on your end for each customer

ConstantinOP•10/25/24, 5:39 PM

i'll give http validation a try

ConstantinOP•10/25/24, 5:41 PM

it seems to be less invasive, if the tenant already have an existing _acme record

ConstantinOP•10/25/24, 5:42 PM

they don't have to replace with my own and break their dns

CConstantin they don't have to replace with my own and break their dns

Chaika•10/25/24, 5:43 PM

Typically you're only going to use non-ent cf for saas on subdomains

Chaika•10/25/24, 5:43 PM

and the _acme record would be on the subdomain as well

Chaika•10/25/24, 5:44 PM

so very little chance of conflicting with something, and if you do, it probably shouldn't be there

ConstantinOP•10/25/24, 5:44 PM

indeed, you're correct

ConstantinOP•10/25/24, 5:44 PM

such a great experience with workers and rpc calls between them!

ConstantinOP•10/25/24, 5:45 PM

kudos all!

ConstantinOP•10/25/24, 5:49 PM

@Chaika and with http validation, cloudflare will do the validation automatically, or i should run/call the cf apis to reissue the certs?

CConstantin @Chaika and with http validation, cloudflare will do the validation automaticall...

Chaika•10/25/24, 5:50 PM

automagically

Chaika•10/25/24, 5:51 PM

CF uses CF For SaaS/Custom Hostnames for Pages Custom Domains (external domains and on cf ones) and for R2 Custom domains, etc. It's pretty nice, just takes care of the hard stuff for you

ConstantinOP•10/25/24, 5:53 PM

nais, nais

fry69•10/25/24, 5:58 PM

Also it is reasonably easy to automate updating certs and dependent DNS records with certbot and DNS APIs like Cloudflare -> https://github.com/fry69/certbot-cloudflare-dns-updaters

kalempster•10/25/24, 6:03 PM

Hey, I've been recently interested in using hono with cloudflare workers and on the hono's docs page I saw a section called "Serve static files""Serve static files" which says that "If you want to serve static files, you can use the Static Assets feature of Cloudflare Workers.""If you want to serve static files, you can use the Static Assets feature of Cloudflare Workers." and I would like to ask if the files are served through cloudflare's cdn or are they served through workers? I don't know if the question makes sense