Cloudflare reverse proxy and DNS

This is a sample article used to preview the Field Notes template. It will be replaced with a real account of setting up a reverse proxy and DNS.

Running more than one application on a single VPS usually means putting something in front of them that can route by hostname. Cloudflare in front of an Nginx reverse proxy is a common way to do that without paying for a load balancer.

The basic shape

• DNS records point each subdomain at the VPS's IP address, proxied through Cloudflare
• Nginx listens on ports 80/443 and routes by server_name to the right local port
• Each application only needs to bind to localhost on its own port

Where it gets tricky

Cloudflare terminates TLS at the edge by default, so the connection between Cloudflare and the origin server can end up unencrypted unless "Full (strict)" mode and a valid origin certificate are both configured. Getting only one of those right looks fine until something inspects the traffic in between.

What I learned

DNS and TLS problems rarely look like DNS and TLS problems — they usually just look like "the site is down," which makes them slower to diagnose than they need to be.