4 ms·

Yes, I never understand this obsession for centralized services like Cloudflare. To be fair though, if our tiny blogs anyway had a hundred or so visitors monthl

Yes, I never understand this obsession for centralized services like Cloudflare. To be fair though, if our tiny blogs anyway had a hundred or so visitors monthly, does it matter if it had an outage for a day?

ThunderSizzle 11mo ago
I think partially is not having to worry about certs is a nice reason to hide behind the proxy. Also, to help hide your IP address, I guess. Of course, on the other hand, I know that relying on Cloudflare cert's is basically inviting a MITM attack.
- huijzer 11mo ago
  > I think partially is not having to worry about certs is a nice reason to hide behind the proxy. Use Caddy. I never worry about certs.
  - ThunderSizzle 11mo ago
    Interesting. I've done a lot of manual work to set up a whole nginx layer to properly route stuff through one domain to various self-hosted services, with way to many hard lessons when I started this journey (from trying to do manual setup without docker, to moving onto repeatable setups via docker, etc.). The setup appears very simple in Caddy - amazingly simple, honestly. I'm going to give it a good try.
  - immibis 11mo ago
    Or certbot-plugin-nginx if you prefer a bit less magic.
- ptx 11mo ago
  Don't you need a cert anyway to secure the connection from Cloudflare to your server?
  - ThunderSizzle 11mo ago
    You could use a self-signed cert, since cloudflare doesn't care about that.
  - omcnoe 11mo ago
    Cloudflare explicitly supports customers placing insecure HTTP only sites behind a cloudflare HTTPS. It's one of the more controversial parts of the business, it makes the fact that the traffic is unencrypted on public networks invisible to the end user.
GreenWatermelon 11mo ago
Problem is when 2 billion Brazilian bots hit your blog daily and exhaust all resources, crashing it and preventing you from posting a new post. If you host images as well, your bandwidth costs might skyrocket. I was pretty much forced into putting a site I'm managing for a client behind cloudflare due to the above-mentioned issue.

ThunderSizzle 11mo ago

I think partially is not having to worry about certs is a nice reason to hide behind the proxy. Also, to help hide your IP address, I guess. Of course, on the other hand, I know that relying on Cloudflare cert's is basically inviting a MITM attack.

huijzer 11mo ago
> I think partially is not having to worry about certs is a nice reason to hide behind the proxy. Use Caddy. I never worry about certs.
- ThunderSizzle 11mo ago
  Interesting. I've done a lot of manual work to set up a whole nginx layer to properly route stuff through one domain to various self-hosted services, with way to many hard lessons when I started this journey (from trying to do manual setup without docker, to moving onto repeatable setups via docker, etc.). The setup appears very simple in Caddy - amazingly simple, honestly. I'm going to give it a good try.
- immibis 11mo ago
  Or certbot-plugin-nginx if you prefer a bit less magic.
ptx 11mo ago
Don't you need a cert anyway to secure the connection from Cloudflare to your server?
- ThunderSizzle 11mo ago
  You could use a self-signed cert, since cloudflare doesn't care about that.
- omcnoe 11mo ago
  Cloudflare explicitly supports customers placing insecure HTTP only sites behind a cloudflare HTTPS. It's one of the more controversial parts of the business, it makes the fact that the traffic is unencrypted on public networks invisible to the end user.

GreenWatermelon 11mo ago

Problem is when 2 billion Brazilian bots hit your blog daily and exhaust all resources, crashing it and preventing you from posting a new post. If you host images as well, your bandwidth costs might skyrocket. I was pretty much forced into putting a site I'm managing for a client behind cloudflare due to the above-mentioned issue.