Use dynamic cloudflare trusted_proxies IP source #5

2026-07-25T04:08:41Z

ahmza commented

2026-07-25 04:08:41 +00:00

Follow-up to PR #4, which was merged just before these two commits landed — so main currently still has the hardcoded static Cloudflare IP list.

Now that caddy-cf bundles WeidiDeng/caddy-cloudflare-ip, this switches the Caddyfile to the dynamic cloudflare IP source, which auto-fetches and refreshes Cloudflare's IPv4/IPv6 ranges — no more 22-line static list to maintain.

trusted_proxies cloudflare {
	interval 12h
	timeout 15s
}
client_ip_headers Cf-Connecting-Ip X-Forwarded-For

Changes

Caddyfile: replace trusted_proxies static <22 ranges> with trusted_proxies cloudflare { interval 12h; timeout 15s }; keep client_ip_headers Cf-Connecting-Ip X-Forwarded-For with an explanatory comment.
docs/caddy-reverse-proxy.md: document the dynamic source as the primary example; note the static-list method as the fallback for builds without the plugin.

Verification

Confirmed http.ip_sources.cloudflare is present in the updated caddy-cf image.
caddy validate + caddy fmt clean.
Runtime-tested (Caddy -> SWS): starts cleanly (no error fetching CF IPs), serves HTTP 200 with gzip + security headers.

Scope note

Cherry-picked onto the current main so the diff is only Caddyfile + docs — it does not touch the media-optimization (#2) or audit-fix (#3) work already merged.

Deploy

After merge, reload the live proxy:

docker exec caddy_cf caddy reload --config /etc/caddy/Caddyfile

Follow-up to PR #4, which was merged just before these two commits landed — so `main` currently still has the hardcoded static Cloudflare IP list. Now that `caddy-cf` bundles [`WeidiDeng/caddy-cloudflare-ip`](https://github.com/WeidiDeng/caddy-cloudflare-ip), this switches the Caddyfile to the dynamic `cloudflare` IP source, which auto-fetches and refreshes Cloudflare's IPv4/IPv6 ranges — no more 22-line static list to maintain. ```caddy trusted_proxies cloudflare { interval 12h timeout 15s } client_ip_headers Cf-Connecting-Ip X-Forwarded-For ``` ## Changes - `Caddyfile`: replace `trusted_proxies static <22 ranges>` with `trusted_proxies cloudflare { interval 12h; timeout 15s }`; keep `client_ip_headers Cf-Connecting-Ip X-Forwarded-For` with an explanatory comment. - `docs/caddy-reverse-proxy.md`: document the dynamic source as the primary example; note the static-list method as the fallback for builds without the plugin. ## Verification - Confirmed `http.ip_sources.cloudflare` is present in the updated `caddy-cf` image. - `caddy validate` + `caddy fmt` clean. - Runtime-tested (Caddy -> SWS): starts cleanly (no error fetching CF IPs), serves HTTP 200 with gzip + security headers. ## Scope note Cherry-picked onto the current `main` so the diff is **only** `Caddyfile` + docs — it does not touch the media-optimization (#2) or audit-fix (#3) work already merged. ## Deploy After merge, reload the live proxy: ```bash docker exec caddy_cf caddy reload --config /etc/caddy/Caddyfile ```

ahmza added 2 commits 2026-07-25 04:08:41 +00:00

Use dynamic cloudflare trusted_proxies IP source b88828f92e

caddy-cf now includes WeidiDeng/caddy-cloudflare-ip, so replace the
hardcoded 22-range static list with 'trusted_proxies cloudflare' which
auto-fetches and refreshes Cloudflare's IPv4/IPv6 ranges (interval 12h,
timeout 15s). No static list to keep in sync when Cloudflare updates.

Kept client_ip_headers Cf-Connecting-Ip X-Forwarded-For (prefer CF's
authoritative end-user IP, fall back to XFF) and documented why.

Validated + fmt-clean and tested end-to-end against the updated caddy-cf
image: starts cleanly, serves HTTP 200 with gzip + security headers.

docs: show dynamic cloudflare trusted_proxies as primary example 2c6f20fbc3

caddy-cf now bundles WeidiDeng/caddy-cloudflare-ip, so document
'trusted_proxies cloudflare { interval 12h; timeout 15s }' as the
primary (auto-refreshing) approach, with the static-list method noted
as the fallback for builds without the plugin. Also explains
client_ip_headers (Cf-Connecting-Ip preferred, X-Forwarded-For fallback).

ahmza merged commit 4b0b681302 into main

2026-07-25 04:09:11 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ahmza/blog-ahmza-com#5