← back to Glassbeadedwallpaper

CLOUDFLARE-SETUP.md

459 lines

# Cloudflare Setup Guide for GlassBeadedWallpaper.com

## Current Status

✅ **Server Running:** Port 3012
✅ **Nginx Configured:** Reverse proxy enabled with Cloudflare support
✅ **Firewall Open:** Port 80 (HTTP) and Port 3012
⏳ **DNS Setup:** Needs configuration in Cloudflare
⏳ **SSL Certificate:** Will be auto-configured by Cloudflare

---

## Server Details

- **Server IP:** 45.61.58.125
- **Application Port:** 3012
- **Domain:** glassbeadedwallpaper.com
- **Nginx Config:** /etc/nginx/sites-available/glassbeadedwallpaper.com

---

## Step 1: Configure DNS Records in Cloudflare

Log into your Cloudflare account and navigate to the DNS settings for glassbeadedwallpaper.com (or add the domain if it's not there yet).

### Required DNS Records

Add the following DNS records:

#### A Record for Root Domain
```
Type: A
Name: @
Content: 45.61.58.125
Proxy status: Proxied (orange cloud icon)
TTL: Auto
```

#### A Record for WWW Subdomain
```
Type: A
Name: www
Content: 45.61.58.125
Proxy status: Proxied (orange cloud icon)
TTL: Auto
```

### Important: Enable Cloudflare Proxy

Make sure the **orange cloud icon** is enabled (Proxied) for both records. This will:
- Enable Cloudflare's CDN
- Provide DDoS protection
- Enable SSL/TLS encryption
- Hide your origin server IP
- Improve performance with caching

---

## Step 2: Configure Cloudflare SSL/TLS Settings

### SSL/TLS Encryption Mode

1. Go to **SSL/TLS** → **Overview**
2. Set encryption mode to: **Full** or **Full (strict)**

**Recommended:** Full (strict) - Most secure option

### Why Full Mode?

- **Flexible:** Cloudflare ↔ Browser (HTTPS), Cloudflare ↔ Server (HTTP) ❌ Not secure
- **Full:** Cloudflare ↔ Browser (HTTPS), Cloudflare ↔ Server (HTTPS with any cert) ✅ Good
- **Full (strict):** Cloudflare ↔ Browser (HTTPS), Cloudflare ↔ Server (HTTPS with valid cert) ✅ Best

Currently, your server uses HTTP on port 80. Cloudflare will handle HTTPS, but for Full (strict), you'll need to install a certificate.

### Edge Certificates (Automatic)

Cloudflare automatically provisions SSL certificates for your domain. This happens within minutes of adding the DNS records.

**To verify:**
1. Go to **SSL/TLS** → **Edge Certificates**
2. Confirm "Universal SSL Certificate" is active
3. Certificate type should be "Universal" or "Advanced"

---

## Step 3: Optional - Install SSL Certificate on Origin Server

For maximum security (Full strict mode), install a Cloudflare Origin Certificate or Let's Encrypt certificate.

### Option A: Cloudflare Origin Certificate (Recommended)

1. In Cloudflare, go to **SSL/TLS** → **Origin Server**
2. Click **Create Certificate**
3. Leave defaults (RSA, 15 years validity)
4. Click **Create**
5. Copy both the certificate and private key

Save the certificate:
```bash
sudo nano /etc/ssl/certs/glassbeadedwallpaper.com.pem
# Paste the certificate
```

Save the private key:
```bash
sudo nano /etc/ssl/private/glassbeadedwallpaper.com.key
# Paste the private key
```

Update Nginx configuration to use HTTPS:
```bash
sudo nano /etc/nginx/sites-available/glassbeadedwallpaper.com
```

Add this server block:
```nginx
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name glassbeadedwallpaper.com www.glassbeadedwallpaper.com;

    ssl_certificate /etc/ssl/certs/glassbeadedwallpaper.com.pem;
    ssl_certificate_key /etc/ssl/private/glassbeadedwallpaper.com.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # ... rest of configuration (copy from port 80 block)
}
```

Reload Nginx:
```bash
sudo systemctl reload nginx
```

### Option B: Let's Encrypt with Certbot (Alternative)

```bash
sudo apt update
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d glassbeadedwallpaper.com -d www.glassbeadedwallpaper.com
```

---

## Step 4: Configure Cloudflare Performance Settings

### Caching Rules

1. Go to **Caching** → **Configuration**
2. Set caching level to **Standard**

### Page Rules (Optional but Recommended)

Create page rules to optimize caching:

#### Rule 1: Cache Everything for Static Assets
```
URL: glassbeadedwallpaper.com/*.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot|webp)
Settings:
  - Cache Level: Cache Everything
  - Edge Cache TTL: 1 month
```

#### Rule 2: Cache JSON Product Data
```
URL: glassbeadedwallpaper.com/*.json
Settings:
  - Cache Level: Cache Everything
  - Edge Cache TTL: 1 hour
```

#### Rule 3: Cache HTML Pages
```
URL: glassbeadedwallpaper.com/*
Settings:
  - Cache Level: Standard
  - Browser Cache TTL: 4 hours
```

---

## Step 5: Configure Cloudflare Security Settings

### Firewall Rules

1. Go to **Security** → **WAF**
2. Enable **Managed Rules**
3. Set security level to **Medium** or **High**

### Bot Fight Mode

1. Go to **Security** → **Bots**
2. Enable **Bot Fight Mode** (free plan)

### DDoS Protection

Automatically enabled with Cloudflare proxy

---

## Step 6: Configure Cloudflare Speed Settings

### Auto Minify

1. Go to **Speed** → **Optimization**
2. Enable **Auto Minify** for:
   - JavaScript
   - CSS
   - HTML

### Brotli Compression

1. In **Speed** → **Optimization**
2. Enable **Brotli** compression

### HTTP/3 (QUIC)

1. Go to **Network**
2. Enable **HTTP/3 (with QUIC)**

### Early Hints

1. In **Speed** → **Optimization**
2. Enable **Early Hints**

---

## Step 7: Test the Configuration

### Before DNS Propagation (Test with hosts file)

Add to `/etc/hosts` on your local machine:
```
45.61.58.125 glassbeadedwallpaper.com
45.61.58.125 www.glassbeadedwallpaper.com
```

Then test:
```bash
curl -I http://glassbeadedwallpaper.com
```

### After DNS Propagation

Wait 5-10 minutes for DNS propagation, then test:

```bash
# Check DNS resolution
dig glassbeadedwallpaper.com

# Test HTTP
curl -I http://glassbeadedwallpaper.com

# Test HTTPS (after SSL setup)
curl -I https://glassbeadedwallpaper.com

# Check SSL certificate
openssl s_client -connect glassbeadedwallpaper.com:443 -servername glassbeadedwallpaper.com
```

### Browser Tests

1. Open http://glassbeadedwallpaper.com
2. Should redirect to https://glassbeadedwallpaper.com (if SSL is configured)
3. Verify products load (631 glass bead products)
4. Check browser console for errors
5. Test mobile responsiveness

---

## Step 8: Verify Cloudflare is Working

### Check if Site is Behind Cloudflare

```bash
dig glassbeadedwallpaper.com
```

If working correctly, you should see Cloudflare IP addresses (not 45.61.58.125).

### Verify SSL Certificate

Open https://glassbeadedwallpaper.com in a browser and check the certificate:
- Issuer should be "Cloudflare Inc" or "Let's Encrypt"
- Should show a green padlock icon
- No certificate errors

### Test Real IP Headers

Your Nginx config is set up to receive the real visitor IP from Cloudflare:
- Check server logs: `/var/log/nginx/access.log`
- Should show actual visitor IPs, not Cloudflare IPs

---

## Cloudflare Nameservers

When you add the domain to Cloudflare, you'll be given nameservers like:
```
ns1.cloudflare.com
ns2.cloudflare.com
```

Update your domain registrar to use these nameservers.

**Common registrars:**
- **Namecheap:** Domain List → Manage → Nameservers → Custom DNS
- **GoDaddy:** My Products → Domains → Manage DNS → Change Nameservers
- **Google Domains:** DNS → Name servers → Use custom name servers

---

## Troubleshooting

### Issue: DNS not resolving

**Solution:**
- Wait 5-10 minutes for DNS propagation
- Clear DNS cache: `sudo systemd-resolve --flush-caches`
- Check nameservers: `dig NS glassbeadedwallpaper.com`

### Issue: 502 Bad Gateway

**Solution:**
- Check PM2 status: `pm2 status glassbeadedwallpaper`
- Check Nginx status: `systemctl status nginx`
- Check firewall: `sudo ufw status | grep 3012`
- Test backend directly: `curl http://localhost:3012/`

### Issue: Mixed content warnings

**Solution:**
- Ensure all resources use HTTPS in your HTML
- Or use protocol-relative URLs: `//example.com/style.css`

### Issue: SSL certificate errors

**Solution:**
- Wait 5-10 minutes for certificate provisioning
- Check Cloudflare SSL settings (should be Full or Full strict)
- Verify Edge Certificate is active in Cloudflare dashboard

### Issue: Slow performance

**Solution:**
- Enable Auto Minify in Cloudflare
- Create Page Rules for caching
- Enable Brotli compression
- Check Cloudflare Analytics for insights

---

## Current Nginx Configuration

Your Nginx config at `/etc/nginx/sites-available/glassbeadedwallpaper.com` includes:

✅ Cloudflare real IP configuration
✅ Security headers
✅ Static asset caching (30 days)
✅ JSON caching (1 hour)
✅ Proxy headers for Cloudflare
✅ Health check endpoint
✅ WebSocket support

---

## Summary Checklist

### Cloudflare Dashboard Setup
- [ ] Add domain to Cloudflare
- [ ] Add A record: @ → 45.61.58.125 (Proxied)
- [ ] Add A record: www → 45.61.58.125 (Proxied)
- [ ] Set SSL/TLS mode to Full
- [ ] Enable Auto Minify
- [ ] Enable Brotli compression
- [ ] Create Page Rules for caching
- [ ] Enable Bot Fight Mode
- [ ] Enable HTTP/3

### Domain Registrar
- [ ] Update nameservers to Cloudflare's nameservers

### Server Configuration (Completed)
- [x] Nginx reverse proxy configured
- [x] Cloudflare real IP configuration
- [x] Firewall port 80 open
- [x] Application running on port 3012
- [x] PM2 auto-restart enabled

### Testing
- [ ] Test HTTP access: http://glassbeadedwallpaper.com
- [ ] Test HTTPS access: https://glassbeadedwallpaper.com
- [ ] Verify 631 products load
- [ ] Check mobile responsiveness
- [ ] Verify Cloudflare is proxying (check DNS)
- [ ] Test from multiple locations
- [ ] Check browser console for errors
- [ ] Verify Class A Fire Rated badges display

---

## Quick Reference Commands

```bash
# Check PM2 status
pm2 status glassbeadedwallpaper

# Check Nginx status
systemctl status nginx

# Reload Nginx after config changes
systemctl reload nginx

# Test Nginx configuration
nginx -t

# View Nginx access logs
tail -f /var/log/nginx/access.log

# View Nginx error logs
tail -f /var/log/nginx/error.log

# Check DNS resolution
dig glassbeadedwallpaper.com

# Test HTTP endpoint
curl -I http://glassbeadedwallpaper.com

# Test HTTPS endpoint
curl -I https://glassbeadedwallpaper.com

# Check if Cloudflare is active
curl -I http://glassbeadedwallpaper.com | grep -i cf-ray
```

---

## Support Resources

- **Cloudflare Documentation:** https://developers.cloudflare.com/
- **Cloudflare Community:** https://community.cloudflare.com/
- **Nginx Documentation:** https://nginx.org/en/docs/

---

**Next Steps:**

1. Log into Cloudflare and add glassbeadedwallpaper.com
2. Configure DNS records as shown above
3. Update nameservers at your domain registrar
4. Wait 5-10 minutes for DNS propagation
5. Test the site!

Your server is ready and waiting for Cloudflare configuration. Once DNS is set up, your site will be live at https://glassbeadedwallpaper.com with full Cloudflare protection and optimization!