Cloudflare Integration

Real IP Restoration

Nginx's ngx_http_realip_module uses two key directives to restore visitor IPs behind a reverse proxy:

• set_real_ip_from -- Defines trusted proxy IP ranges (one directive per CIDR block)
• real_ip_header -- Specifies which HTTP header contains the real client IP (e.g., CF-Connecting-IP for Cloudflare, X-Forwarded-For for most other proxies)

Where to Add the Configuration

You can add the real IP directives in two locations:

Automated Setup (Recommended)

Centmin Mod 123.09beta01 and newer generates Nginx vhosts with an include file that is automatically populated with Cloudflare IPs via the csfcf.sh automation script.

Uncomment the Cloudflare include in your vhost configuration:

# uncomment cloudflare.conf include if using cloudflare for
# server and/or vhost site
include /usr/local/nginx/conf/cloudflare.conf;

Set up a cron job to keep Cloudflare IPs updated automatically:

23 */36 * * * /usr/local/src/centminmod/tools/csfcf.sh auto >/dev/null 2>&1

Cloudflare IP Ranges

Cloudflare maintains an updated list of IP addresses. Below are the IP ranges formatted as Nginx directives.

IPv4 Addresses

# Cloudflare IPv4
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
real_ip_header CF-Connecting-IP;

IPv6 Addresses

# Cloudflare IPv6
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;
real_ip_header CF-Connecting-IP;

Using an Include File

For easier management, place the directives in a separate include file and reference it from your Nginx configuration:

# In nginx.conf http{} block or vhost server{} block:
include /usr/local/nginx/conf/cloudflare.conf;

After making changes, restart Nginx:

# Restart Nginx
service nginx restart

# Or use the Centmin Mod shortcut
ngxrestart

Full nginx.conf Context Example

Here is an example showing where the Cloudflare directives fit within the full nginx.conf structure:

user              nginx nginx;
worker_processes  1;
worker_rlimit_nofile 51200;
error_log         logs/error.log;
pid               logs/nginx.pid;

events {
    worker_connections  32768;
    use epoll;
}

http {
    # Cloudflare real IP restoration
    include /usr/local/nginx/conf/cloudflare.conf;

    index  index.php index.html index.htm;
    include       mime.types;
    default_type  application/octet-stream;
    # ... rest of config
}

SSL Modes

Cloudflare offers several SSL/TLS encryption modes that determine how traffic is encrypted between visitors, Cloudflare, and your origin Nginx server.

Let's Encrypt SSL with Cloudflare DNS API

For the most secure configuration, combine Cloudflare Full (Strict) mode with a Let's Encrypt SSL certificate on your origin Nginx server. When your domain is behind Cloudflare's orange cloud proxy, use Cloudflare DNS API validation to issue Let's Encrypt SSL certificates.

Cloudflare DNS API Configuration

Add these settings to /etc/centminmod/custom_config.inc:

Then issue the SSL certificate using DNS validation:

For full details on Cloudflare DNS API validation and all available options, see the Let's Encrypt DNS Validation documentation.

Full (Strict) SSL Mode

For the most secure configuration, combine Cloudflare Full (Strict) mode with the Let's Encrypt certificate on your origin Nginx server.

Setup Steps

1. Install a Let's Encrypt certificate on your origin server using Centmin Mod's built-in addons/acmetool.sh integration.
2. Configure your Nginx vhost for HTTPS/SSL with the Let's Encrypt certificate.
3. In your Cloudflare dashboard, navigate to SSL/TLS and set the encryption mode to Full (Strict).
4. Enable Authenticated Origin Pulls in Cloudflare to verify that requests to your origin come from Cloudflare.
5. Ensure your origin server's set_real_ip_from directives include the current Cloudflare IP ranges.

Page Rules & Caching

Cloudflare Page Rules allow you to customize caching behavior, security settings, and URL redirects on a per-URL basis. Here are recommended configurations for Centmin Mod sites.

Recommended Cache Settings

Performance Optimization Tips

• Enable Auto Minify for HTML, CSS, and JavaScript in Cloudflare's Speed settings.
• Enable Brotli compression in Cloudflare (works alongside Nginx's built-in Brotli in Centmin Mod).
• Use Always Online to serve cached pages even when your origin is temporarily unavailable.
• Consider enabling Argo Smart Routing for reduced latency on dynamic content.
• Enable HTTP/2 and HTTP/3 (QUIC) in Cloudflare's Network settings for faster connections.

Firewall Integration

When using Cloudflare with CSF Firewall, you need to whitelist Cloudflare's IP addresses in the firewall to ensure traffic can reach your origin server.

Automated CSF + Cloudflare Setup

Centmin Mod includes the csfcf.sh script that automates both Cloudflare IP whitelisting in CSF and Nginx real IP configuration:

# Run the automated setup
/usr/local/src/centminmod/tools/csfcf.sh auto

# Set up a cron job to keep IPs updated
23 */36 * * * /usr/local/src/centminmod/tools/csfcf.sh auto >/dev/null 2>&1

This script handles:

• Downloading the latest Cloudflare IP ranges
• Adding Cloudflare IPs to CSF Firewall's allow list (csf.allow)
• Updating the Nginx cloudflare.conf include file with current IP ranges
• Restarting CSF and Nginx to apply changes

Troubleshooting