Health check behind Cloudflare Zero Trust

Hello,
netcheck: measuring HTTP(S) latency of coder (999): Get "https://woo.cloudflareaccess.com/cdn-cgi/access/login/mycool.domain?kid=475fa3b3af1772616cd8a7b9ffc1fca94481a0fe8e1c234996e9ace1e4739708&redirect_url=%2Fderp%2Flatency-check&meta=eyJraWQ...gibberish...yCnF96Akl1XC2V18ug": only one conn expectednetcheck: [v1] report: udp=true v6=false v6os=true mapvarydest=false hair= portmap= v4a=myip:37822 derp=0
netcheck: measuring HTTP(S) latency of coder (999): Get "https://woo.cloudflareaccess.com/cdn-cgi/access/login/mycool.domain?kid=475fa3b3af1772616cd8a7b9ffc1fca94481a0fe8e1c234996e9ace1e4739708&redirect_url=%2Fderp%2Flatency-check&meta=eyJraWQ...gibberish...yCnF96Akl1XC2V18ug": only one conn expectednetcheck: [v1] report: udp=true v6=false v6os=true mapvarydest=false hair= portmap= v4a=myip:37822 derp=0
Hello, I host coder through cloudflare tunnel, and I config it behind cloudflare zero trust, so basically you have to login in order to access the site (without it coder works great), but I want to see how further I can protect it, but I got some trouble here: When coder try to pinging health check it meet with the error above. And according to cloudflare, one way to solve/pass it is through service token, so basically you attach some token before send a request to mycool.domain/healthz.
7 Replies
Codercord
Codercord2w ago
<#1363202083083260076>
Category
Feature request
Product
Coder (v2)
Platform
Linux
Logs
Please post any relevant logs/error messages.
ÙwÚ
ÙwÚOP2w ago
I have no luck with when looking through the health check docs, so if anyone can guide me where to add this if it possible to do or do I have to get rid of zero trust all together
Phorcys
Phorcys2w ago
@ÙwÚ could you do a per-ip whitelist? i don't think we support setting custom headers when doing the health check
ÙwÚ
ÙwÚOP2w ago
per ip whitelist does work good to know, I'll work with ip whitelist for now
Phorcys
Phorcys2w ago
i've added the "improvement-needed" tag to this thread so i can come back later and investigate further maybe you could use some kind of proxy too, or overwrite the DNS records so that it only points to the internal server
ÙwÚ
ÙwÚOP2w ago
I wish:) my house is behind cgnat, lots of limitation on my part
Codercord
Codercord2w ago
@Phorcys closed the thread.

Did you find this page helpful?