I had self-hosted services on a Raspberry Pi using Docker in my college room. Since I couldn’t set up port forwarding, I couldn’t enable HTTPS for them. I know that I can still have https without port forwarding but it is not straightforward and difficult for me. And, I used cloudflare tunnel to access them from outside my college network. When I access them using cloudflare tunnel, it uses HTTPS. However, I found conflicting information online about the connection between the server and cloudflare, with some sources saying it’s HTTP and others saying it’s HTTPS. What’s true?
You should be able to set it up, which seems to be the crux of your question.
The reason for the conflict is likely that the traffic is encrypted through the tunnel, but cloudflare holds the certificates needed to verify the identity of your site and can see all the traffic.
But tunnels are done by having your server initiate the connection with cloudflare, so it behaves like a client in terms of networking, and it should work in most cases.
(Worth noting that video was against their policies for using at least the free tunnels last I was aware, so if that’s part of your use case you might not be able to use it.)
I believe Cloudflare has a trusted root cert that is distributed with browsers and such, and for tunnels, they generate a signed cert for that hostname interaction, and act as a reverse proxy to your machine when called. This should always show as an HTTPS host, but there must be a mechanism via DNS or something to identify and authorize your host to serve HTTPS, and if that lapses for some reason, I would assume they default to plain HTTP.
I’m just thinking about this logically and having used this particular setup though.
The answer depends on how you’re serving your content. Based on what you’ve described about your setup, your content is likely served over HTTP through the secured tunnel. The tunnel acts like an encrypted VPN, which allows unencrypted content to be sent securely over the wire. This means although your web server is serving unencrypted content, it gets encrypted before it goes to Cloudflare, so no one along the path could snoop on it.
The Tunnel daemon creates an encrypted tunnel between your origin web server and Cloudflare’s nearest data center, all without opening any public inbound ports.
Cloudflare tunnels uses a QUIC connection between the cloudflared on the server and Cloudflare itself, which is encrypted similarly to HTTPS.
Whatever protocol cloudflared uses to talk to your webserver locally is configurable through the Cloudflare access web UI (just change http to https). I’ve actually got it configured to use unix sockets, which lets me treat it differently in my nginx config.
Nobody can answer this because it depends entirely on how you set it up. It can be set up either way. Whatever you point your internal endpoint at is what it is.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
You should be able to set it up, which seems to be the crux of your question.
The reason for the conflict is likely that the traffic is encrypted through the tunnel, but cloudflare holds the certificates needed to verify the identity of your site and can see all the traffic.
But tunnels are done by having your server initiate the connection with cloudflare, so it behaves like a client in terms of networking, and it should work in most cases.
(Worth noting that video was against their policies for using at least the free tunnels last I was aware, so if that’s part of your use case you might not be able to use it.)
I believe Cloudflare has a trusted root cert that is distributed with browsers and such, and for tunnels, they generate a signed cert for that hostname interaction, and act as a reverse proxy to your machine when called. This should always show as an HTTPS host, but there must be a mechanism via DNS or something to identify and authorize your host to serve HTTPS, and if that lapses for some reason, I would assume they default to plain HTTP.
I’m just thinking about this logically and having used this particular setup though.
The tunnels are encrypted. But I don’t know if they use SSL or something else.
The answer depends on how you’re serving your content. Based on what you’ve described about your setup, your content is likely served over HTTP through the secured tunnel. The tunnel acts like an encrypted VPN, which allows unencrypted content to be sent securely over the wire. This means although your web server is serving unencrypted content, it gets encrypted before it goes to Cloudflare, so no one along the path could snoop on it.
From https://www.cloudflare.com/products/tunnel/
Cloudflare tunnels uses a QUIC connection between the
cloudflaredon the server and Cloudflare itself, which is encrypted similarly to HTTPS.Whatever protocol
cloudflareduses to talk to your webserver locally is configurable through the Cloudflare access web UI (just change http to https). I’ve actually got it configured to use unix sockets, which lets me treat it differently in my nginx config.Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
[Thread #929 for this sub, first seen 20th Aug 2024, 20:05] [FAQ] [Full list] [Contact] [Source code]
Nobody can answer this because it depends entirely on how you set it up. It can be set up either way. Whatever you point your internal endpoint at is what it is.
What you read online may have been referring to how cloudflare itself can always see the unencrypted traffic?
Cloudflare tunnels are encrypted, but inside of that encrypted tunnel could be a regular http stream.