526 Error on Cloudflare-issued SSL Certificates reddit / selfhosted ---------------------------------------------------------------------- maxkmiller · 2023-12-28 18:39 Hi everyone, I've been using [this tutorial](https://www.youtube.com/watch?v=c6Y6M8CdcQ0) to attempt to use Cloudflare and NGINX with my Squarespace domain as a proxy for my Jellyfin server on Unraid. I've been running into a few issues, and my google searches have been unfruitful. On NGINX when I try to add a proxy host using what I've set up in Cloudflare, if I try to request a new SSL Certificate, it just says "internal error" with no other messages. So I tried to go the route of having Cloudflare issue my own certificates on the Origin Server page, which NGINX accepts, but then the site gives a 526 Error. If I toggle the encryption mode to Flexible, it "works," but it only directs to the root of my Unraid server, not the Jellyfin docker like it's supposed to. When I switch it back to Full or Full/Strict it goes back to the error. Any help would be appreciated! ---------------------------------------------------------------------- FrumunduhCheese · 2023-12-28 22:24 Have you maybe missed Declaring the server ip in any of the sites that are hosted? In Apache if you leave the vhost set to 0.0.0.0 sometime cloudflare will do funny things. I was in a Similar boat. ---------------------------------------------------------------------- maxkmiller · 2023-12-28 22:26 I don't totally follow your instructions, I'm a noob with this stuff - however I did just get it to work suddenly! Changing the Unraid and NPM ports, then redoing my NPM proxy from scratch seemed to do it! The site is *only* accessible through the http, www or blank prefix does not work, but I'm happy! ---------------------------------------------------------------------- zfa · 2023-12-28 22:37 TBH what you want contravenes the Cloudflare TOS anyway so I wouldn't worry about it, lol. Just find some other approach. *(depending how much traffic you put through CF you might get away with it or you might not. If you carry on with this approach make sure you disable caching so you're at least only abusing their bandwidth and not their caches as well)* ---------------------------------------------------------------------- maxkmiller · 2023-12-28 22:42 I wasn't aware of this, can you explain a bit more? How do I disable caching? Would disabling proxy on Cloudflare affect anything? ---------------------------------------------------------------------- zfa · 2023-12-28 22:48 > I wasn't aware of this, can you explain a bit more? As per the current non-Enterprise TOS published here: https://www.cloudflare.com/en-gb/service-specific-terms-application- services/#content-delivery-network-terms >> *Cloudflare’s content delivery network (the “CDN”) Service can be used to cache and serve web pages and websites. Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid Services to serve video or a disproportionate percentage of pictures, audio files, or other large files. We will use reasonable efforts to provide you with notice of such action.* ---- > How do I disable caching? Easiest way is to apply a `Cache Rule` which matches your JF hostname and enables `Bypass Cache`. Its in your dash under Caching-Cache Rules. > Would disabling proxy on Cloudflare affect anything? Disabling proxying at Cloudflare will fix the issue as you then wouldn't have Cloudflare in the loop at all (wrt streaming) and users will hit your NPM instance directly. Note that this means they'll see your Cloudflare Origin certificate so may have issues - if you go that route you'll just want to let NPM gen 'normal' certs for you. ---------------------------------------------------------------------- maxkmiller · 2023-12-28 22:53 > Note that this means they'll see your Cloudflare Origin certificate so may have issues - if you go that route you'll just want to let NPM gen 'normal' certs for you. Thank you, can you explain this part as well? I can essentially take Cloudflare out of the loop, but then my network is less secure? ---------------------------------------------------------------------- zfa · 2023-12-28 22:56 > Thank you, can you explain this part as well? I can essentially take Cloudflare out of the loop, but then my network is less secure? Adding CF in front of you probably makes things more secure but properly configured NPM isn't exactly insecure in the first place. Millions and millions of people are just fine online without CF in front of their nginx servers. ---------------------------------------------------------------------- maxkmiller · 2023-12-28 22:57 awesome. so feasibly I could just keep going with my current setup and if I get flagged on CF I could just continue with NPM? ---------------------------------------------------------------------- zfa · 2023-12-28 23:46 Yeah. They first give you a warning; next they replace your videos with a text about being in breach of tos; then they disable your proxying; then only after all that you kicked, lol. But do disable caching, you want to at least try to keep your head below the parapet.