Caddy2 with Cloudflare CDN (end-to-end encryption)

Cloudflare settings

dashboard->profile->API Tokens->Create API Token->Create Custom Token

1. name the token
2. Permissions->zone->zone read/dns edit/analytic read
3. Zone Resources->specific zone->your site domain

do NOT use global API key

dashboard->site domain->dns & ssl/tls

1. an A record for the site
2. encryption mode：Full Strict
3. enable Always Use HTTPS

Caddy installation

pick one of two

• build from source：https://github.com/caddyserver/xcaddy#readme

  xcaddy build --with github.com/caddy-dns/cloudflare

• quick install and replace

  1. apt install

     sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
     curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo tee /etc/apt/trusted.gpg.d/caddy-stable.asc
     curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
     sudo apt update -y
     sudo apt install caddy -y

  2. download (https://caddyserver.com/download) with plugin (dns.providers.cloudflare)

  3. replace the quick installed one at /usr/bin/caddy

• verify dns.providers.cloudflare module

  ./caddy list-modules | grep dns

Caddyfile

Enable the ACME DNS-01 challenge for the domain managed on Cloudflare with AUTH TOKEN
Here’s my caddyfile

star.us.org:443 {
    encode gzip
    root * /hexo
    file_server
    tls {
         dns cloudflare <AUTH_TOKEN>
         }
    log {
         output file /var/log/caddy/hexo-access.log
         }
}

ACME Challenge Types：
HTTP-01
DNS-01
TLS-ALPN-01
TLS-SNI-01 disabled in March 2019

Logging client IP behind a Cloudflare proxy

• https://github.com/kirsch33/realip/issues/14
• https://caddyserver.com/docs/caddyfile/options#trusted-proxies
• https://caddyserver.com/docs/caddyfile/directives/log

Note that as of Caddy v2.7, both remote_ip and client_ip are logged, where client_ip is the “real IP” when trusted_proxies is configured

example: In global options, at the top of Caddyfile

{
	servers {
		trusted_proxies static 12.34.56.0/24 1200:ab00::/32
		client_ip_headers Cf-Connecting-Ip
	}
}

Caddy run

setcap CAP_NET_BIND_SERVICE=+eip $(which caddy)
caddy run --config ~./Caddyfile

REF

• https://caddy.community/t/setting-up-cloudflare-for-caddy-2/8955/5
• https://caddyserver.com/docs/caddyfile/directives/tls
• https://sammckenzie.be/en/blog/using-caddy-with-cloudflare/