Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
Hi, can I purchase my domain elsewhere? The other commenter mentioned something about changing nameservers, how would the process you describe be different from just changing nameservers (if I have a domain name from a different provider)?
It's basically the same. Like they said, you just follow the intructions on cloudflare to change the name servers on your registrar and then you're good
Thank you for your comment. I'm going through the cloudflare docs, and I have a question: why do we need to change our nameservers to Cloudflare's? I know this might sound like a noob networking question but I just can't seem to figure it out. Thanks!
No problem! You change the name servers on your registrar to cloudflare's so that when traffic goes to your.domain, cloudflare is the one that processes the dns request.
If you kept the name servers of your registrar then the traffic would just be processed by the registrar, cloudflare wouldn't even see the traffic.
Basically the name server defines your domain's current dns provider.
Hope that makes sense
Ah, this is what I'm confused about. I get that traffic would need to flow through Cloudflare's network, but why would Cloudflare require me to change my nameserver for that? How about a CNAME alias instead? What are the technical limitations for which Cloudflare asks this of me? I just want to understand the working behind them asking me to change my nameservers.
Thanks!
Setting your nameservers is simply a requirement for Cloudflare. While they theoretically could work via CNAME -- they don’t. On the other hand, their DNS is really nice and is free.
When you use their DNS, for each DNS record, you have the option to proxy traffic through Cloudflare. The proxy is what enables their CDN (and many other features such as forwarding, rewriting URLs, DDoS protection, automatic HTTPS certificates, and so on). It’s a simple on/off switch for each DNS record if you don’t want to proxy a particular host.
When you make a dns request, it goes to the nameservers first to see which server is has the dns config. A CNAME record is in the dns config
I'm sorry, what I don't understand is how does changing my nameservers to cloudflare's nameservers help propagating my traffic through their CDN infrastructure?
Because changing your nameservers to cloudflare's allows you to use their DNS service, which comes with the CDN infrastructure.
Here is the cloudflare dns for my lemmy server's domain:
The switch where it says proxied means that I am using the CDN to obfuscate the real IP of the server.
Thank you, but I'm still having trouble understanding the technical reason for Cloudflare to require users to change their nameservers. Let me try and summarise what I understand:
When a user changes their nameservers to Cloudflare nameservers, all requests to the domain are routed to Cloudflare's DNS endpoints. Because we are using a CDN (and are proxying traffic to our site through Cloudflare), the CDN endpoint (because it is the proxy) intercepts all traffic directed towards our domain. If we were to not change the nameservers for our domain to Cloudflare's nameservers, Cloudflare would not be able to link our domain to the specific CDN endpoint it has likely set up for us at the back-end, which would defeat the purpose of the CDN and the proxying wouldn't work.
Do I understand this correctly?
Pretty much yes.
If you want a more in-depth explanation of DNS and how nameservers work etc check out this article from cloudflare.
Specifically the part; "There are 4 DNS servers involved in loading a webpage:" It explains it much better than I can.
Thank you, I conceptually understand what nameservers (and their types) are, it's just that I'm struggling a bit to link my understanding of DNS to how Cloudflare is proxying traffic through its own network. I assume that my previous comment had an OK explanation, a high-level overview of what happens.
Thanks for your time!
Cloudflare has several reverse proxies all around the world. When you enable their proxy service, CF decides which proxy is used for your traffic. To be able to control this better, they need to have control over the DNS record.
If you have an issue with changing your domain's nameservers (perfectly valid), my guess is you'll also have an issue with the fact that using CF proxy essentially means they are a man-in-the-middle for all your HTTPS traffic and decrypt everything before proxying it forward.
Hi, thanks a bunch for your comment. I love trying to understand the inner workings of more complex networking.
Could you detail on how using their nameservers helps them control the allocation of proxies and other infrastructure better? I'm probably asking a stupid question but I really want to connect the dots. I want to know how using their nameservers enables them to proxy my traffic, and what technical limitations are present such that they won't be able to proxy my traffic if I don't use their nameservers (which btw is not true, because if you are an enterprise customer they have a provision where you can just get a CNAME instead of using their nameserver and it will still work - but for the sake of this discussion I will assume that it won't be possible to proxy traffic without their nameservers. I just want to know why).
Well, technically using Cloudflare isn't the most private thing one can do (I have a feeling they ask free account holders to use their nameservers because they can then run analytics on the data, which is fine. It's "free"), and eventually I'd like to use my own VPS instance as a reverse proxy into my network (to access it from outside) instead of having to use a Cloudflare proxy. However, when strictly speaking of CDN infrastructure, I have no problems with using Cloudflare, since there is no chance of me coming up with infrastructure on my own anyway.
I didn't realise that Cloudflare acts as a MiTM: this is new for me. I would love if you could explain further (or point me to a resource that does) and how this ties in with using Cloudflare as a proxy/CDN setup.
Thanks!
The reasons for having to use their nameservers is probably about getting some data in the process. But DNS queries are quite harmless compared to the MITM issue for the actual traffic.
Traffic proxied via CF uses their TLS certificates. Look up how HTTPS works, and you'll understand that it means the encryption is terminated at Cloudflare.
For the record, CF DNS infrastructure is really solid. For something already public anyway, I'd use their services in a heartbeat. You get some WAF features and can add firewall rules like geoblocking, even on the free tier.
For sensitive data, I probably wouldn't use the proxy service.
Ah, I think I'm starting to understand. Since they ask you to replace the default certificates with Cloudflare specific certificates, in order for these certificates to be authorised, the nameserver needs to be from CF.
But then, if they were to not use their own specific certificate, this would not be a limitation, yes? (As I imagine is the case with the more premium plans). In the case of the premium plans, how do they secure traffic and provide proxy/CDN services with just a CNAME?
A CNAME is just a DNS record that points to another DNS record, technically they could allow it for free users too.
I'd guess the point is they get info on what free users do with their DNS, to help make their paid services more appealing.
No offense, but you might be seriously overthinking this.
Ah, perfect. My hypothesis was correct!
Haha, I'm aware I'm probably trying to delve deeper than most users, but I really want to understand the technology I plan to use. I am also very interested in Networking and such concepts intrigue me!
Could you tell me how proxying traffic would work if they just asked the user to create a CNAME rather than using their nameservers? I still can't figure this part out.
My apologies for asking so many questions, but I just can't seem to rest till I wrap my head around this :)
No need to apologize.
You'd create a CNAME for
myservice.mydomain.com, that points toproxynearorigin.cloudflare.com.proxynearorigin.cloudflare.comcontains the A and AAAA records for the reverse proxy servers. When you do a DNS query formyservice.mydomain.com, it will (eventually) resolve to the CF proxy IPs.The CF proxies see from the traffic that you originally requested
myservice.mydomain.comand serve your content based on that. This still requires you to tell Cloudflare where the origin server is so the reverse proxies can connect to it.On the free service instead of the CNAME you set the origin server's IP as the A and/or AAAA record. Enabling the proxy service actually changes this so that when someone makes a DNS query to
myservice.mydomain.comthey get the proxy addresses straight as A and AAAA records, leaving the IP you originally configured known only to Cloudflare internally.It's hard to explain this, and since I don't work at Cloudflare the details may be off too. The best way to get an idea is play around with something like NGINX and run a local DNS server (Bind, Unbound, dnsmasq, PiHole...) and see for yourself how the DNS system works.
CDN isn't really related to DNS at all. In the case of the CF free tier, it's actually more like caching static content, which is technically a bit different. A CDN is a service that replicates said static content to multiple locations on high-performant servers, allowing the content to always be served from close to to the client. Where DNS comes in is that Anycast is probably used, and
cdn.cloudflare.comactually resolves to different IPs depending on where the DNS query is made from.There's also the chance that I don't actually know what I'm talking about, but luckily someone will most likely correct me if that's the case. :)