How to use Cloudflare proxy in custom domain

[oritwoen]

Summary

How can I use a proxy for a domain on Cloudflare? Now, in order for my domain assigned to the wasmer application to work, I have to disable the proxy.

In most platforms, it is possible to enable the proxy and use the certificate through such solutions:

• https://developer.tenten.co/how-to-host-webflow-behind-cloudflare-proxy

For wasmer it does not work.

Additional details

Provide any additional details here.

[syrusakbary]

Hey @oritwoen , we are just adding support for caching in Wasmer Edge, so hopefully creating a proxy will no longer be needed.

@theduke can you follow-up on what steps could be made to make it work via Cloudflare?

[oritwoen]

To be honest, I'm not just talking about the cache. Without a proxy for a given domain, I can't do redirects using "Bulk Redirects", I can't use "Cloudflare Zaraz" or "page rules".

[theduke]

Edge does support some redirect rules similar to Cloudflare rules. Those aren't customisable though app.yaml yet, but will be soon.

BUT it's odd that your domain doesn't work through Cloudflare.
What's the problem that occurs?
In theory it should work just fine.

[oritwoen]

It works, but with the proxy turned off. Maybe I expressed myself badly. I simply have the entire infrastructure on Cloudflare and the app on wasmer works after connecting to Cloudflare but I cannot use special functionalities that require a proxy because after turning on the proxy there is an error about handshake ssl.

[theduke]

Ahh, right, I remember the issue now.

The problem is that Edge uses LetsEncrypt to provision a certificate for you.
If Cloudflare proxying is enabled, then Edge won't be able to provision a certificate, because Cloudflare intercepts the LetsEncrypt validation methods.

In theory allowing the app to be served over HTTP should make things work, though I'll test and get back to you on that.
By default apps are always redirected to HTTPs.
See https://docs.wasmer.io/edge/configuration#redirectforce_https

[theduke]

@oritwoen

Confirmed: If you disable the force_https setting by adding

redirect:
  force_https: false

to your app.yaml, proxy mode on Cloudflare works.

The downside is that traffic between Cloudflare and Wasmer Edge servers will go over http and won't be encrypted.
Solving that is not entirely trivial.

If this is important for you we could implement a setting that will force Edge to use a self-signed certificate for a given app.
This would make Cloudflare proxying over HTTPS (in the "flexible mode") work, although any of the *.wasmer.app domains would show the usual insecure website warning in browsers.

See https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/#custom-ssltls

[theduke]

@oritwoen just as a followup, we will look into making this work with no manual user intervention needed.