ahmza/blog-ahmza-com
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use dynamic cloudflare trusted_proxies IP source

Browse Source 
caddy-cf now includes WeidiDeng/caddy-cloudflare-ip, so replace the
hardcoded 22-range static list with 'trusted_proxies cloudflare' which
auto-fetches and refreshes Cloudflare's IPv4/IPv6 ranges (interval 12h,
timeout 15s). No static list to keep in sync when Cloudflare updates.

Kept client_ip_headers Cf-Connecting-Ip X-Forwarded-For (prefer CF's
authoritative end-user IP, fall back to XFF) and documented why.

Validated + fmt-clean and tested end-to-end against the updated caddy-cf
image: starts cleanly, serves HTTP 200 with gzip + security headers.
This commit is contained in:
ahmza
2026-07-25 05:01:49 +01:00
parent c24ed01e0a
commit ce7a72728d
1 changed files with 12 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Caddyfile
+12 -27
View File
@@ -15,34 +15,19 @@
# X-Forwarded-For) are honoured only when the request actually comes from # X-Forwarded-For) are honoured only when the request actually comes from
# Cloudflare. This prevents header spoofing from any other source. # Cloudflare. This prevents header spoofing from any other source.
# #
# Ranges from https://www.cloudflare.com/ips-v4/ and /ips-v6/ . # The `cloudflare` IP source (WeidiDeng/caddy-cloudflare-ip, baked into the
# Keep in sync when Cloudflare updates them (rarely). If you rebuild # caddy-cf image) auto-fetches the ranges from cloudflare.com/ips-v4 and
# caddy-cf with the caddy-dynamic-cloudflare / caddy-cloudflare-ip plugin, # /ips-v6 and refreshes them periodically, so there's no static list to
# this static list can be replaced with `trusted_proxies cloudflare`. # keep in sync.
servers { servers {
trusted_proxies static \ trusted_proxies cloudflare {
173.245.48.0/20 \ interval 12h
103.21.244.0/22 \ timeout 15s
103.22.200.0/22 \ }
103.31.4.0/22 \ # Read the real visitor IP from these headers (only honoured for
141.101.64.0/18 \ # requests from trusted_proxies above). Cf-Connecting-Ip is
108.162.192.0/18 \ # Cloudflare's single authoritative end-user IP; X-Forwarded-For is
190.93.240.0/20 \ # the fallback if a request ever arrives without the CF header.
188.114.96.0/20 \
197.234.240.0/22 \
198.41.128.0/17 \
162.158.0.0/15 \
104.16.0.0/13 \
104.24.0.0/14 \
172.64.0.0/13 \
131.0.72.0/22 \
2400:cb00::/32 \
2606:4700::/32 \
2803:f800::/32 \
2405:b500::/32 \
2405:8100::/32 \
2a06:98c0::/29 \
2c0f:f248::/32
client_ip_headers Cf-Connecting-Ip X-Forwarded-For client_ip_headers Cf-Connecting-Ip X-Forwarded-For
} }
} }