Cloudflare tunnel with reverse proxy
reddit / selfhosted

----------------------------------------------------------------------
Alucard14224 · 2023-09-30 02:44

I know this is probably here somewhere. I can't find a straight up
answer for my specific question.
 Self hosting about a year or so. Want to expose some applications to
the outside world.
I want to know if I use a cloudflare tunnel to point to my local
reverse proxy with ssl would cloudflare be able to see? So as follows
for incoming traffic.

Public>>Cloudflare tunnel>>nginx>>application

Thank you in advanced.

----------------------------------------------------------------------
ericesev · 2023-09-30 03:03

Yes, I use CF tunnels this way, You can configure a wildcard CNAME in
DNS that sends all requests to the tunnel endpoint,

----------------------------------------------------------------------
Alucard14224 · 2023-09-30 03:05

And the information with maintain encryption out of cloudflares prying
eyes?

----------------------------------------------------------------------
ericesev · 2023-09-30 03:07

>local reverse proxy with ssl would cloudflare be able to see

Oh, sorry, I missed that part.

>And the information with maintain encryption out of cloudflares
prying eyes?

No, Cloudflare will see everything. It only does TLS hop-to-hop
encryption, not end-to-end.
https://www.cloudflare.com/learning/privacy/what-is-end-to-end-
encryption

----------------------------------------------------------------------
Alucard14224 · 2023-09-30 03:12

Alright cool thank you for this info. I'm trying to find the safest
easiest way to expose and stay private at the same time. Friends and
family use this application and I'm tired of configuring vpns for
them.

----------------------------------------------------------------------
ericesev · 2023-09-30 03:17

>Friends and family use this application and I'm tired of configuring
vpns for them.

I totally understand. I also avoid VPNs. I use CF tunnels for public
sites. For my homelab services I use an authenticating reverse proxy.

----------------------------------------------------------------------
Alucard14224 · 2023-09-30 06:23

One more question. I set up cloudflare account to use It as a primary
dns anyways is using the proxy setting in the cname essentially the
same thing as in they would decrypt the information on there end and
then send it re encrypted with the new ssl? Or is that specifically
the zero trust tunnel that would do that?

----------------------------------------------------------------------
ericesev · 2023-09-30 07:00

The proxy setting is the same. Cloudflare will be able to see the
data.

If you have nginx setup with a certificate already, there is a quick
way to verify. Visit the site with the proxy off and take note of
which certificate is used by your browser. Then turn the proxy on. The
certificates will be different. Cloudflare owns the private key for
their proxy, and that is what allows Cloudflare to see all the data.

----------------------------------------------------------------------
Alucard14224 · 2023-09-30 07:17

Cool man thanks. I'm to novice to feel comfortable not going through
cloudflare so I guess I'll just bite the bullet.