Cloudflare

Cloudflare hosts the authoritative DNS for our zones and sends web traffic through its own global network to the origin server. The A, AAAA and CNAME records that serve web traffic are proxied: DNS answers return Cloudflare anycast addresses instead of the origin IP, so HTTP and HTTPS requests travel across the Cloudflare network. A DNS-only record answers with the real address of the server, which exposes the origin to anyone who queries it. Every record that serves web traffic therefore stays proxied, and Cloudflare applies its own configurations and timeouts to proxied requests.

Zone, DNS and proxy

• Only records used for IP address resolution can be proxied, meaning A, AAAA and CNAME. MX and TXT records are always DNS-only.
• When several A or AAAA records share a name and at least one is proxied, Cloudflare treats all of them as proxied.
• A proxied record has an automatic TTL of 300 seconds that cannot be edited, so resolvers cannot cache an old address for longer.
• Cloudflare flattens CNAME chains, and proxied CNAME records are flattened by default.
• The zone is delegated at the registrar: nameservers point to Cloudflare, while API tokens and access control live at the account level.
• Traffic reaches our nginx reverse proxy through that network.

TLS modes

The encryption mode of a zone governs two connections: visitor to Cloudflare, and Cloudflare to origin.

• Off: neither leg is encrypted, everything is plain HTTP.
• Flexible: the visitor leg is HTTPS, while Cloudflare reaches the origin over unencrypted HTTP, so no origin certificate is needed. It only applies on port 443 and falls back to Full elsewhere. The documentation does not recommend it for applications handling logins or personalized data.
• Full: both legs are encrypted, but Cloudflare does not validate the origin certificate, so an expired or self-signed one is accepted.
• Full (strict): the certificate must be unexpired, issued by a publicly trusted authority or Cloudflare Origin CA, and its CN or SAN must match the hostname. Otherwise visitors see a 526 error.
• Automatic SSL/TLS is the default: it picks the most secure working mode from probe measurements and rolls the change out gradually, with rollback on failure.

Tunnel: a service without an inbound port

Cloudflare Tunnel connects resources to the Cloudflare network without a publicly routable IP address. The cloudflared daemon creates outbound connections to Cloudflare, so the firewall needs no inbound port. Traffic then flows both ways over the tunnel.

• A tunnel is a persistent object identified by a UUID, the logical link between origin and Cloudflare.
• Several cloudflared processes, called connectors, can run against one tunnel, each connecting to the nearest data center.
• A published application route maps a hostname to the internal service: the Service URL typically looks like http://localhost:8000.
• Our cloudflared runs under Docker.

Workers

Cloudflare Workers is a serverless platform: application code runs on the Cloudflare global network and deploys with a single command through the Wrangler CLI, in JavaScript, TypeScript, Python or Rust.

• A Worker receives HTTP requests and returns responses; routing, headers and redirects are decided in that code.
• Long-running work belongs to Workflows, and Smart Placement tunes latency for background requests.
• Bindings connect further services: D1, KV, R2, Queues, Hyperdrive, Vectorize and Workers AI.
• A static site does not need a Worker: an Astro build can be served as plain files, and a Worker comes into play when a decision must happen at the edge.

Further reading

• Proxy status
• Encryption modes
• Cloudflare Tunnel

At CyberElectro Cloudflare is the authoritative DNS and the front door: our zones live there, web records are proxied, and Tunnel publishes the self-hosted services without opening an inbound port.