Cloudflare DNS - Zone Setup, Proxying, and SSL Modes

Status: Active
Last Updated: 2026-08-26
Category: Networking - DNS Hosting
Prerequisites: dns-management, ../security/tls-configuration
Time: 3 hours
Tags: cloudflare, dns, proxy, cdn, ssl-tls, api-tokens

Summary

Setting up the fogserv.cloud zone on Cloudflare: proxied (orange-cloud) vs DNS-only records, scoped API tokens for automation, Origin Rules, and choosing an SSL/TLS mode that actually encrypts end to end. Cloudflare is our DNS host and the public edge in front of the reverse proxy.

🎯 What You'll Learn

By the end of this article, you'll be able to:

✅ Decide proxied vs DNS-only per record
✅ Create least-privilege API tokens for DDNS, ACME DNS-01, and zone export
✅ Use Origin Rules to publish non-standard ports
✅ Pick and verify the correct SSL mode (Full strict)

Context / Why This Matters
Proxied vs DNS-Only
SSL/TLS Modes
API Tokens
Origin Rules
Troubleshooting & Common Pitfalls
Next Steps / Ops Actions
Sources & Related
Change Log

Context / Why This Matters

Cloudflare sits between internet users and our edge host: it terminates TLS at their edge, filters obvious garbage, hides our home IP behind their anycast addresses, and only then forwards to our Caddy/Traefik (reverse-proxy-basics). That's a big lever — but misconfigured SSL modes or over-scoped tokens quietly undo the benefits.

Proxied vs DNS-Only

	Proxied (orange)	DNS-only (grey)
Resolves to	Cloudflare anycast IPs	Your real IP
TLS terminated at	Cloudflare edge	Your origin
Ports available	Limited set (80/443/2053/2083/2087/2096/8443 + 8080/8880/2052/2082/2086/2095 http)	Any
Hides origin IP	Yes	No
Good for	Public web services (`grafana`, `git`)	`vpn` A record for WireGuard (UDP not proxied!), mail, anything non-HTTP

Rule: everything public-HTTP is proxied; everything that isn't HTTP-over-their-ports is grey — most importantly the WireGuard endpoint record (wireguard-setup, dynamic-dns).

SSL/TLS Modes

Overview → SSL/TLS → encryption modes:

Off            ❌ plain HTTP from visitor onward
Flexible       ❌ CF→origin is PLAINTEXT http:80 — never use with a self-hosted origin
Full           ⚠ encrypted, but origin cert not validated (MITM-able)
Full (strict)  ✅ encrypted AND origin cert must be valid (LE cert or CF Origin CA cert)

Set Full (strict). Then give the origin a cert it can present:

Option A: real Let's Encrypt cert via DNS-01 through Caddy/Certbot (caddy-reverse-proxy, ../security/letsencrypt-automation).
Option B: free Cloudflare Origin CA cert (15-year validity, trusted only by Cloudflare). Fine when all inbound comes through the proxy; it fails validation for direct connections, so don't mix with grey-cloud names on the same vhost.

Verify end-to-end:

curl -sv https://grafana.fogserv.cloud 2>&1 | grep -E "issuer|subject"
# issuer should be a Cloudflare edge cert (Google Trust Services/Let's Encrypt via CF)

# On the edge host: confirm origin side is TLS too
sudo tcpdump -i any port 80 and host <edge-ip>   # should stay silent once Full(strict)+certs work

Also enable "Always Use HTTPS" and set minimum TLS version 1.2.

API Tokens

Profile → API Tokens → Create Token. Least privilege, one token per job:

Token name	Permissions	Scope
`ddns-updater`	`Zone.DNS Edit`	Only the `vpn.fogserv.cloud` record (zone-scoped, name filter)
`acme-dns01`	`Zone.DNS Edit`	`fogserv.cloud` zone (for `_acme-challenge` TXT)
`readonly-export`	`Zone.Zone Read` + `Zone.DNS Read`	`fogserv.cloud` zone

# Test a token
curl -s -H "Authorization: Bearer $CF_TOKEN" \
  https://api.cloudflare.com/client/v4/user/tokens/verify | jq .

Store tokens in your secrets manager, not in scripts (../security/vault-secrets); never commit them.

Origin Rules

Origin Rules let you rewrite where proxied traffic goes — host, port, or SNI — without exposing extra ports publicly.

Example: send jellyfin.fogserv.cloud to origin port 8096 while visitors still use 443:

Rules → Origin Rules → Create:

When:  hostname eq jellyfin.fogserv.cloud
Then:  Destination Port → Rewrite to 8096

(Origin must allow it: open 8096 only to Cloudflare IP ranges in firewalls-nftables.)

Other uses: route home.fogserv.cloud to a different internal LAN host, or override DNS resolution target to an internal IP when the public A record points elsewhere.

Practical Examples

Confirm what the world sees vs reality:

dig +short grafana.fogserv.cloud     # 104.x/172.x → Cloudflare anycast = proxied ✔
dig +short vpn.fogserv.cloud         # your real home IP = DNS-only ✔ (required for WG)

Block direct-to-origin bypass: after confirming all public services are proxied, restrict 443 on the edge firewall to Cloudflare's published ranges only — otherwise anyone who learns your IP skips CF entirely.

Troubleshooting & Common Pitfalls

Problem	Cause	Fix
Error 526 on all sites after switching to Full (strict)	Origin has no valid cert yet	Install LE/Origin cert first, then flip mode
WireGuard clients can't connect	`vpn` record got proxied (orange)	Set DNS-only; UDP isn't proxied
Websocket/streaming apps flaky through proxy	CF proxy buffering/timeouts	Enable WebSockets; consider grey-cloud for heavy media paths or tune settings
Redirect loop after enabling Always Use HTTPS	Origin also redirecting http→https behind proxy	Set SSL mode correctly and remove origin-level redirect duplication
API automation returns auth error 9109	Token lacks zone scope or expired	Recreate scoped token; verify with tokens/verify
Real IP leaked via other subdomains	Grey-cloud A records share the origin IP	Keep non-web endpoints on different records/IPs where possible

Next Steps / Ops Actions

Point the edge reverse proxy at these records: reverse-proxy-basics, traefik-v3-reverse-proxy
Automate wildcard certs with DNS-01: caddy-reverse-proxy
Keep the home IP updated: dynamic-dns
Restrict edge ingress to CF ranges: firewalls-nftables

Sources & Related

External references consulted:

Change Log

2026-08-26

Initial creation: proxied/DNS-only policy, SSL modes, token scoping, Origin Rules.