| Name | cloudflare-only-nginx JSON |
| Version |
1.0.0
JSON |
| download |
| home_page | |
| Summary | nginx-style network configuration |
| upload_time | 2024-01-22 23:01:59 |
| maintainer | |
| docs_url | None |
| author | |
| requires_python | >=3.8 |
| license | MIT |
| keywords |
cloudflare
nginx
|
| VCS |
 |
| bugtrack_url |
|
| requirements |
No requirements were recorded.
|
| Travis-CI |
No Travis.
|
| coveralls test coverage |
No coveralls.
|
# CloudFlare-only nginx
[](https://www.python.org/)
[](https://pypi.org/project/cloudflare-only-nginx/)
[](https://opensource.org/licenses/MIT)
[](https://github.com/c0m4r/cloudflare-only-nginx/actions)
[](https://www.codefactor.io/repository/github/c0m4r/cloudflare-only-nginx)
This repository contains a complete configuration examples for CloudFlare-only nginx.
The goal is to close your web server to cloudflare-only traffic using firewall rules and [CloudFlare IP list](https://www.cloudflare.com/ips/).
You can accept traffic from both IPv4 and IPv6, however even having IPv6 only server doesn't mean that you cannot serve your website to IPv4 clients. You can use CloudFlare to achieve that. It's enough to set up only AAAA record in the CloudFlare DNS configuration. CloudFlare will communicate with your origin server via IPv6 and send responses to clients connecting from both IPv4 and IPv6 addresses.
Use [Origin CA Certificates](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/) for strict end-to-end encryption.
Keep in mind that CloudFlare will only use tcp/443 port (HTTPS). We don't need to expose 80/tcp.
## Log real client IP
With [realip module](https://nginx.org/en/docs/http/ngx_http_realip_module.html) you can log real client IP sent by CloudFlare in [CF-Connecting-IP header](https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/).
Edit nginx.conf and add these settings inside `http` section:
## nginx configuration
```
# realip
include cloudflare.ipv4.conf;
include cloudflare.ipv6.conf;
real_ip_header CF-Connecting-IP;
```
## iptables
Before you use the script, make sure that incoming tcp/443 traffic is pointing to CLOUDFLARE chain.
```
-N CLOUDFLARE
-A INPUT -p tcp -m tcp --dport 443 -j CLOUDFLARE
```
If your INPUT default policy is ACCEPT, make sure to run cloudflare_ips_reload.py with `--target DROP`
## Helper script
```
usage: cloudflare_ips_reload.py [-h] [-4] [-6] [-s] [--chain CHAIN] [--target TARGET]
CloudFlare-only nginx
https://github.com/c0m4r/cloudflare-only-nginx
options:
-h, --help show this help message and exit
-4, --ipv4 only reload configuration for IPv4
-6, --ipv6 only reload configuration for IPv6
-s, --silent silent mode - only prints errors
--chain CHAIN iptables chain name (default: CLOUDFLARE)
--target TARGET iptables chain target (default: RETURN)
```
This script will recreate iptables CLOUDFLARE chain and allow traffic from only CloudFlare networks, then recreate realip configuration and reload nginx.
By default, with no options passed, it will recreate rules for both IPv4 and IPv6.
### PyPI installation
```
pip install cloudflare-only-nginx
cloudflare-only-nginx --help
```
## License
> MIT License
>
> Copyright (c) 2023 c0m4r
>
> Permission is hereby granted, free of charge, to any person obtaining a copy
> of this software and associated documentation files (the "Software"), to deal
> in the Software without restriction, including without limitation the rights
> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
> copies of the Software, and to permit persons to whom the Software is
> furnished to do so, subject to the following conditions:
>
> The above copyright notice and this permission notice shall be included in all
> copies or substantial portions of the Software.
>
> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
> SOFTWARE.
## Funding
If you found this software helpful, please consider [making donation](https://en.wosp.org.pl/fundacja/jak-wspierac-wosp/wesprzyj-online) to a charity on my behalf. Thank you.
Raw data
{
"_id": null,
"home_page": "",
"name": "cloudflare-only-nginx",
"maintainer": "",
"docs_url": null,
"requires_python": ">=3.8",
"maintainer_email": "",
"keywords": "cloudflare,nginx",
"author": "",
"author_email": "c0m4r <github@wolfet.pl>",
"download_url": "https://files.pythonhosted.org/packages/9f/3d/bd389823121b22b1cce527637c2c67bfb9ecc56775c42f57094abd228cb4/cloudflare-only-nginx-1.0.0.tar.gz",
"platform": null,
"description": "# CloudFlare-only nginx\n\n[](https://www.python.org/)\n[](https://pypi.org/project/cloudflare-only-nginx/)\n[](https://opensource.org/licenses/MIT)\n[](https://github.com/c0m4r/cloudflare-only-nginx/actions)\n[](https://www.codefactor.io/repository/github/c0m4r/cloudflare-only-nginx)\n\nThis repository contains a complete configuration examples for CloudFlare-only nginx.\n\nThe goal is to close your web server to cloudflare-only traffic using firewall rules and [CloudFlare IP list](https://www.cloudflare.com/ips/).\n\nYou can accept traffic from both IPv4 and IPv6, however even having IPv6 only server doesn't mean that you cannot serve your website to IPv4 clients. You can use CloudFlare to achieve that. It's enough to set up only AAAA record in the CloudFlare DNS configuration. CloudFlare will communicate with your origin server via IPv6 and send responses to clients connecting from both IPv4 and IPv6 addresses.\n\nUse [Origin CA Certificates](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/) for strict end-to-end encryption.\n\nKeep in mind that CloudFlare will only use tcp/443 port (HTTPS). We don't need to expose 80/tcp.\n\n## Log real client IP\n\nWith [realip module](https://nginx.org/en/docs/http/ngx_http_realip_module.html) you can log real client IP sent by CloudFlare in [CF-Connecting-IP header](https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/).\n\nEdit nginx.conf and add these settings inside `http` section:\n\n## nginx configuration\n\n```\n# realip\ninclude cloudflare.ipv4.conf;\ninclude cloudflare.ipv6.conf;\nreal_ip_header CF-Connecting-IP;\n```\n\n## iptables\n\nBefore you use the script, make sure that incoming tcp/443 traffic is pointing to CLOUDFLARE chain.\n\n```\n-N CLOUDFLARE\n-A INPUT -p tcp -m tcp --dport 443 -j CLOUDFLARE\n```\n\nIf your INPUT default policy is ACCEPT, make sure to run cloudflare_ips_reload.py with `--target DROP`\n\n## Helper script\n\n```\nusage: cloudflare_ips_reload.py [-h] [-4] [-6] [-s] [--chain CHAIN] [--target TARGET]\n\nCloudFlare-only nginx\nhttps://github.com/c0m4r/cloudflare-only-nginx\n\noptions:\n -h, --help show this help message and exit\n -4, --ipv4 only reload configuration for IPv4\n -6, --ipv6 only reload configuration for IPv6\n -s, --silent silent mode - only prints errors\n --chain CHAIN iptables chain name (default: CLOUDFLARE)\n --target TARGET iptables chain target (default: RETURN)\n```\n\nThis script will recreate iptables CLOUDFLARE chain and allow traffic from only CloudFlare networks, then recreate realip configuration and reload nginx.\n\nBy default, with no options passed, it will recreate rules for both IPv4 and IPv6.\n\n### PyPI installation\n\n```\npip install cloudflare-only-nginx\ncloudflare-only-nginx --help\n```\n\n## License\n\n> MIT License\n> \n> Copyright (c) 2023 c0m4r\n> \n> Permission is hereby granted, free of charge, to any person obtaining a copy\n> of this software and associated documentation files (the \"Software\"), to deal\n> in the Software without restriction, including without limitation the rights\n> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n> copies of the Software, and to permit persons to whom the Software is\n> furnished to do so, subject to the following conditions:\n> \n> The above copyright notice and this permission notice shall be included in all\n> copies or substantial portions of the Software.\n> \n> THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n> SOFTWARE.\n\n## Funding\n\nIf you found this software helpful, please consider [making donation](https://en.wosp.org.pl/fundacja/jak-wspierac-wosp/wesprzyj-online) to a charity on my behalf. Thank you.\n",
"bugtrack_url": null,
"license": "MIT",
"summary": "nginx-style network configuration",
"version": "1.0.0",
"project_urls": {
"Homepage": "https://github.com/c0m4r/cloudflare-only-nginx",
"Issues": "https://github.com/c0m4r/cloudflare-only-nginx/issues"
},
"split_keywords": [
"cloudflare",
"nginx"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "b08689321bbe8e3956f0835b603b3bc34f196c3c513f22c0b1e5fd8f310cc0b6",
"md5": "8f22df5c6c0b3f8923edb59b8f043afb",
"sha256": "0a4dfad071bdc2ef12415ec19b91e7ad13605440194f36f150656629897b195e"
},
"downloads": -1,
"filename": "cloudflare_only_nginx-1.0.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "8f22df5c6c0b3f8923edb59b8f043afb",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.8",
"size": 7095,
"upload_time": "2024-01-22T23:01:57",
"upload_time_iso_8601": "2024-01-22T23:01:57.713779Z",
"url": "https://files.pythonhosted.org/packages/b0/86/89321bbe8e3956f0835b603b3bc34f196c3c513f22c0b1e5fd8f310cc0b6/cloudflare_only_nginx-1.0.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "9f3dbd389823121b22b1cce527637c2c67bfb9ecc56775c42f57094abd228cb4",
"md5": "190f5d75b5b6407546ce04eabaa6cb75",
"sha256": "86a2ff35468241048b995210e2020ef53227f597057a4f207efef1ba166a7733"
},
"downloads": -1,
"filename": "cloudflare-only-nginx-1.0.0.tar.gz",
"has_sig": false,
"md5_digest": "190f5d75b5b6407546ce04eabaa6cb75",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.8",
"size": 5296,
"upload_time": "2024-01-22T23:01:59",
"upload_time_iso_8601": "2024-01-22T23:01:59.829438Z",
"url": "https://files.pythonhosted.org/packages/9f/3d/bd389823121b22b1cce527637c2c67bfb9ecc56775c42f57094abd228cb4/cloudflare-only-nginx-1.0.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-01-22 23:01:59",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "c0m4r",
"github_project": "cloudflare-only-nginx",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"lcname": "cloudflare-only-nginx"
}
