Skip to main content

Cloudflare

Overview​

Cloudflare provides DNS management, CDN, DDoS protection, and secure origin connectivity for opshell.dev.

DNS Configuration​

RecordTypeValue
opshell.devACloudflare proxied IP
www.opshell.devCNAMEopshell.dev
*ACloudflare proxied IP

Cloudflare Tunnels​

Secure origin connectivity is established via Cloudflare Tunnels (cloudflared):

  • No public IP exposure to origin server
  • Tunnel runs as systemd service on the VPS
  • Auto-restart on failure via systemd
  • Argo Smart Routing disabled (standard tunnels)

Tunnel Setup​

cloudflared tunnel create opshell
cloudflared tunnel route dns opshell opshell.dev
cloudflared --config /etc/cloudflared/config.yml run

Security Configuration​

FeatureStatus
DDoS protectionEnabled
WAF rulesCustom rules for admin area protection
SSL/TLSFull (strict)
Always Use HTTPSEnabled
HSTSEnabled (.dev requirement)
Bot Fight ModeEnabled

Caching​

  • Static assets cached at edge (CSS, JS, images)
  • HTML caching via Cache Rules for anonymous visitors
  • Bypass cache for logged-in admin users
  • Cache purge on content publish via webhook

Analytics​

  • Cloudflare Web Analytics for privacy-focused traffic tracking
  • Security events monitoring
  • Cache hit ratio tracking
  • Bandwidth usage monitoring