Hacker News Reader

Comment by HL33tibCe7 | Hacker News Reader

> It’s often desirable to have HTTPS for your site. Dokku makes this easy with the Let’s Encrypt Plugin, which will even auto-renew for you. I don’t use this, because I’m letting Cloudflare handle this with its proxy.

Hopefully you do use TLS between Cloudflare and your Dokku (even with a self-signed cert or something), otherwise your personal sites (which are apparently sensitive enough to put behind basic auth) are being transited over the internet in plaintext.

View on HN

From my understanding Cloudflare can generate origin certs for exactly this purpose and you can add certs to dokku with `dokku certs:add myapp`

Agreed. It also can't hurt to setup a firewall or EC2 Security Group that only allows ingress from Cloudflare IPs: https://www.cloudflare.com/ips/

Alternatively, you can use Cloudflare Tunnel, and then block all incoming connections.

they also provide certs for mTLS between cloudflare and your origin, which you can layer in along with IP restrictions

(the term they use is “authenticated origin pull”)

You have to limit the traffic to that pool to prevent people accessing your server directly. But that's not enough on its own, because other people can use CloudFlare's IPs to scan you too, so you need some kind of auth on top or use the tunnel.

Yes, this is correct. If you're using IP address allowlists then you also have to check the Host HTTP header (Cloudflare won't allow their other customers to forge that header). Or, you can use mTLS (as another commenter pointed out), or tunnels (as I pointed out): https://news.ycombinator.com/item?id=26690388

Typically my servers is behind NAT and it has no public address, one can only reached the service through the CF tunnel and my access is through VPN, this should be safe, right?

Can you issue wildcard certificates with Dokku? It seems like you need to have a proxy domain to register the TXT records, since you do not know the domain of the user in advance.

Genuinely curious what the threat model is here?

One might be avoid mass traffic interception due to malicious or corrupt BGP rules, either by accident or on purpose by a nation-state or telco. Another might be avoiding interception by your own ISP for various purposes.

You can avoid both of those easily using Cloudflare Tunnels, which seamlessly works with their proxying CDN.

Reply on news.ycombinator.com