Cloudflare

Overview

Cloudflare provides CDN, DDoS protection, DNS, SSL, WAF, and edge computing (Workers). Free tier includes unlimited bandwidth, DNS, basic DDoS protection, and SSL.

Instructions

Step 1: DNS Management

Point your domain nameservers to Cloudflare, then manage DNS via dashboard or API.

bash
# Cloudflare API — manage DNS records
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records" \
  -H "Authorization: Bearer CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"type":"A","name":"app","content":"1.2.3.4","proxied":true}'

Step 2: SSL/TLS

Always use Full (Strict) mode in production:

• Flexible: CF terminates SSL, HTTP to origin (insecure)
• Full: HTTPS to origin, self-signed OK
• Full (Strict): HTTPS to origin, valid cert required (recommended)

Step 3: Terraform Management

hcl
# cloudflare.tf — Infrastructure as code
resource "cloudflare_record" "app" {
  zone_id = var.cloudflare_zone_id
  name    = "app"
  content = "1.2.3.4"
  type    = "A"
  proxied = true
}

Step 4: Workers (Edge Compute)

javascript
// worker.js — Runs at the edge, <1ms cold start
export default {
  async fetch(request) {
    const url = new URL(request.url)
    if (url.pathname === '/api/health') {
      return new Response('OK', { status: 200 })
    }
    return fetch(request)    // pass through to origin
  }
}

Guidelines

• Free tier: unlimited bandwidth, DDoS protection, DNS, shared SSL.
• Orange cloud (proxied) = traffic through Cloudflare. Grey cloud = DNS only.
• Workers: 100K requests/day free, <1ms cold starts.
• Always use Full (Strict) SSL — Flexible mode is a security risk.