smom-dbis-138/frontend-dapp/CLOUDFLARE_CONFIGURATION.md

Cloudflare Configuration Guide

Date: 2025-01-22

📊 Current Status

✅ DNS Configuration

Domain: cross-all.defi-oracle.io

DNS Resolution:

cross-all.defi-oracle.io → 172.67.209.228
cross-all.defi-oracle.io → 104.21.91.43

Status: ✅ Configured and resolving (Cloudflare IPs)

---

⚠️ Cloudflare 522 Error

Current Situation

• HTTP Status: 522 (Connection Timeout)
• HTTPS Status: 522 (Connection Timeout)
• SSL Certificate: ✅ Valid (Cloudflare-issued)
• DNS: ✅ Resolving correctly

522 Error Meaning: Cloudflare cannot connect to the origin server.

---

🔧 Cloudflare Configuration Required

Step 1: Access Cloudflare Dashboard

1. Log into Cloudflare dashboard: https://dash.cloudflare.com
2. Select domain: defi-oracle.io
3. Navigate to DNS section

Step 2: Configure DNS A Record

Current Configuration (Verify):

• Type: A
• Name: cross-all
• Content: [Origin Server IP] ← This must be NPMplus public IP
• Proxy Status: ✅ Proxied (Orange Cloud) ← Should be enabled
• TTL: Auto (or 300)

Required Configuration:

1. Origin Server IP: Must be the public IP address of your NPMplus server

   • This is the IP that Cloudflare will connect to
   • Should be the public IP of the server hosting NPMplus (192.168.11.11's public IP)

2. Proxy Status:

   • ✅ Enabled (Orange Cloud) - Routes through Cloudflare
   • ⚠️ Disabled (Grey Cloud) - Direct DNS only

3. Verify:

   • The A record content should point to your NPMplus server's public IP
   • Not the private IP (192.168.11.166)
   • Not localhost

Step 3: Verify Origin Server Accessibility

Check if origin server is accessible:

# Test from external network (if possible)
curl -I http://[NPMPLUS_PUBLIC_IP]/

# Test with Host header
curl -I -H "Host: cross-all.defi-oracle.io" http://[NPMPLUS_PUBLIC_IP]/

Requirements:

• Origin server must be accessible from the internet
• Port 80 (HTTP) and 443 (HTTPS) must be open
• Firewall must allow Cloudflare IP ranges

Step 4: Cloudflare SSL/TLS Settings

1. Navigate to SSL/TLS section in Cloudflare
2. SSL/TLS encryption mode: Should be "Full" or "Full (strict)"
   • Full: Encrypts connection between Cloudflare and origin
   • Full (strict): Same as Full, but validates origin certificate
3. Always Use HTTPS: Enable (optional but recommended)

Step 5: Verify Origin Server Configuration

NPMplus Server:

• Must be accessible from internet on port 80/443
• Must accept connections from Cloudflare IP ranges
• Must have proper firewall rules

Backend Server:

• Running and accessible: ✅ http://192.168.11.211/ (HTTP 200)
• NPMplus proxy configured: ✅ Active

---

🔍 Troubleshooting

Issue: 522 Connection Timeout

Possible Causes:

1. Origin server IP incorrect in Cloudflare DNS
2. Origin server not accessible from internet
3. Firewall blocking Cloudflare IPs
4. Port 80/443 not open on origin server
5. NPMplus not listening on public IP

Solutions:

1. Verify Origin IP in Cloudflare:

   • Check DNS A record content
   • Must be public IP of NPMplus server
   • Not private IP (192.168.11.x)

2. Check Firewall Rules:

   # On NPMplus server
   # Allow Cloudflare IP ranges (see Cloudflare documentation)
   # Allow port 80 and 443 from anywhere (or Cloudflare IPs)
   

3. Verify NPMplus Accessibility:

   # Test if NPMplus is accessible externally
   # From external network or Cloudflare test tool
   curl -I http://[NPMPLUS_PUBLIC_IP]:80/
   

4. Check NPMplus Configuration:

   • Verify NPMplus is listening on public interface
   • Check NPMplus nginx configuration
   • Verify proxy host is active

Issue: SSL Certificate Errors

Cloudflare SSL:

• Cloudflare provides SSL automatically when proxy is enabled
• SSL certificate is Cloudflare-issued (this is normal)
• No action needed for Cloudflare SSL

Origin SSL (if using Full strict):

• NPMplus must have valid SSL certificate
• Certificate must match domain name
• Can be self-signed for Full strict (Cloudflare accepts it)

---

📋 Cloudflare IP Ranges

If you need to whitelist Cloudflare IPs in firewall:

IPv4: https://www.cloudflare.com/ips-v4 IPv6: https://www.cloudflare.com/ips-v6

Common IPv4 Ranges:

173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22

---

✅ Verification Steps

1. Check DNS Configuration

dig cross-all.defi-oracle.io +short
# Should return Cloudflare IPs: 172.67.209.228, 104.21.91.43

2. Check Origin Server

# Verify NPMplus is accessible (from internal network)
curl -I -H "Host: cross-all.defi-oracle.io" http://192.168.11.166/

# Verify backend is accessible
curl -I http://192.168.11.211/

3. Check Cloudflare Status

• Access Cloudflare dashboard
• Check DNS records
• Verify proxy status (orange cloud)
• Check SSL/TLS settings

4. Test Domain Access

# Test HTTP
curl -I http://cross-all.defi-oracle.io/

# Test HTTPS
curl -I https://cross-all.defi-oracle.io/

# Should return HTTP 200 (not 522)

---

📊 Current Configuration Summary

✅ Complete

• ✅ DNS configured in Cloudflare
• ✅ SSL certificate active (Cloudflare-issued)
• ✅ NPMplus proxy configured
• ✅ Backend server deployed and running
• ✅ All local services operational

⚠️ Needs Configuration

• ⚠️ Cloudflare origin server IP
• ⚠️ Origin server accessibility from internet
• ⚠️ Firewall rules for Cloudflare IPs
• ⚠️ SSL/TLS mode in Cloudflare

---

🎯 Next Steps

1. Configure Cloudflare Origin:

   • Set A record to NPMplus public IP
   • Verify proxy status (orange cloud)

2. Verify Accessibility:

   • Test origin server from external network
   • Check firewall rules

3. Configure SSL/TLS:

   • Set SSL/TLS mode to "Full" or "Full (strict)"
   • Enable "Always Use HTTPS"

4. Test Access:

   • Test domain access: https://cross-all.defi-oracle.io/
   • Verify HTTP 200 (not 522)

---

Last Updated: 2025-01-22
Status: DNS Configured, Cloudflare Origin Configuration Needed