Working with Cloudflare

The tracker works with Cloudflare in two places. In the Domains («Домены») section, the Domain on Cloudflare («Домен на Cloudflare») checkbox doesn't let you add a domain without Cloudflare proxying. In the Admin panel → Reverse proxy nodes («Админ-панель → Реверс-прокси ноды») section, Cloudflare API tokens give the tracker the right to change domain A records by itself. Owners and admins add Cloudflare domains and tokens.

Adding a domain behind Cloudflare

First set up the domain in Cloudflare: the A record points to the IP of the tracker server, and proxying is on (orange cloud).

1. Open Domains.
2. Click + Domain («+ Домен»), or on a phone, the + button at the bottom of the screen.
3. Enter the domain in the Domain («Домен») field, for example go.example.com. For several domains, put each one on a new line.
4. Select the Domain on Cloudflare checkbox.
5. Fill in the other fields — they're described on the Domains page.
6. Click Add («Добавить»), or with several domains, Add (N) («Добавить (N)»).

When adding, the tracker checks where the DNS of each domain with the checkbox points:

• at least one address belongs to Cloudflare — the domain is added;
• DNS isn't responding yet — the domain is added, and proxying will be checked later by the automatic domain check;
• the addresses bypass Cloudflare (gray cloud) — the domain isn't added. The add window stays open. Close it: a message with the list of such domains is shown above the table. The other domains from the list are added and appear in the table within 30 seconds.

A domain with the checkbox has the “Cloudflare” label in the Features («Возможности») column. The Edit («Изменить») window has no such checkbox: it is set only when adding. While the cloud is gray, changes to such a domain aren't saved.

SSL mode in Cloudflare

Domains from the Domains section that point to the tracker server work in the Full, Full (strict) and Flexible modes.

Two cases require a specific mode:

• Domains pointed to a reverse proxy node: the node accepts only HTTP on port 80 from Cloudflare, so the Flexible mode is required.
• The panel domain and the tracking domain from the first-run wizard aren't part of the Domains section. Behind Cloudflare, they need the Full (strict) mode — see the server requirements.

Creating and adding an API token

The token is needed only if you use reverse proxy nodes. Domains behind Cloudflare that point to the tracker server work without a token.

1. In Cloudflare, create an API token with the Zone:Read and Zone.DNS:Edit permissions for the zones of the domains you will point to reverse proxy nodes.
2. Open Admin panel → Reverse proxy nodes.
3. In the Cloudflare API block, paste the token into the CF API token (Zone:Read + Zone.DNS:Edit permissions) («CF API-токен (права Zone:Read + Zone.DNS:Edit)») field.
4. If needed, enter a name in the label (optional) («метка (необязательно)») field. Without a label, the entry is named Cloudflare (N зон).
5. Click Add token («Добавить токен»).

The tracker checks the token by requesting the list of zones from Cloudflare. On success, the message “Cloudflare account added (N zones available).” («Cloudflare-аккаунт добавлен (N зон доступно).») appears above the node table, and the Cloudflare API block shows a row with the label and the date it was added. The token itself isn't shown in the panel after saving.

Several accounts

If your domains are in different Cloudflare accounts, add a token for each of them: the tracker itself finds the token that has access to the domain's zone. The zone is looked up by the name of the domain and its parent domains — for lp.go.example.com, the example.com zone will do.

Deleting a token

Click delete («удалить») in the token row and confirm the prompt “Delete Cloudflare account ‘label’?” («Удалить Cloudflare-аккаунт «метка»?»). The DNS records in Cloudflare don't change. The tracker will no longer be able to point domains from this token's zones to reverse proxy nodes.

What the tracker does through the token

The tracker finds the domain's zone and creates or updates its A record with the IP of the reverse proxy node. The record is set as proxied (orange cloud) with automatic TTL.

This happens in two cases:

• you route domains to a reverse proxy node in the Route domains to a node («Направить домены на ноду») block;
• a reverse proxy node stopped responding, and the tracker itself moves its domains to another responding node.

How this works and the conditions for automatic failover are covered on the Reverse proxy nodes page.

What the tracker doesn't do

• It doesn't add domains or zones to Cloudflare.
• It doesn't change the SSL mode or other zone settings.
• It doesn't change or delete other DNS records.
• It doesn't add a domain to the Domains section — that's done manually.
• It doesn't return the A record to the tracker server when a reverse proxy node or a token is deleted: the record is changed manually in Cloudflare.

Checking the result

1. Open Domains.
2. Click ⟳ in the domain row, or on a phone, ⟳ Check («⟳ Проверить»).
3. Look at the DNS row in the window that opens.

A domain with the Domain on Cloudflare checkbox is considered ready when all four check stages are passed and all its addresses belong to Cloudflare. If some A or AAAA records bypass Cloudflare, the DNS row says “Not all addresses are proxied by Cloudflare” («Не все адреса проксированы Cloudflare»): turn on proxying for all records of the domain and click Check («Проверить»). The other statuses and messages are covered on the Domain check page.

If something went wrong

Domain(s) on Cloudflare not proxied (gray cloud) and exposing the server IP: go.example.com. Turn on proxying (orange cloud) and retry. («Домен(ы) на Cloudflare не проксированы (серое облако) и раскрывают IP сервера: go.example.com. Включите проксирование (оранжевое облако) и повторите.»)

The domains from the message bypass Cloudflare and weren't added. Turn on proxying for their A records in Cloudflare and add these domains again.

Domain on Cloudflare not proxied (gray cloud) and exposing the server IP. Turn on the orange cloud. («Домен на Cloudflare не проксирован (серое облако) и раскрывает IP сервера. Включите оранжевое облако.»)

The message appears above the domain table when a domain with the checkbox is saved in the Edit window or its group is changed in the table. The Edit window stays open. Turn on proxying in Cloudflare and save again.

token failed the check: … («токен не прошёл проверку: …»)

Cloudflare didn't return the list of zones for this token; Cloudflare's response follows the colon. Create a token with the Zone:Read and Zone.DNS:Edit permissions and add it again.

Routed 0 domain(s) to node 203.0.113.10; failed 1: go.example.com (not found) («Направлено 0 домен(ов) на ноду 203.0.113.10; не удалось 1: go.example.com (not found)»)

The message appears after you click Route selected (N) («Направить выбранные (N)»). None of the added tokens gave access to the domain's zone, or there are no tokens. Add a token for the account that holds the domain's zone and route the domain again.

If the text in parentheses starts with cloudflare:, Cloudflare rejected the change to the domain's A record, and its response follows. Check that the token has the Zone.DNS:Edit permission.