DNS and Cloudflare

NexCMP needs one DNS name — its main domain — and works in two modes.

Mode A: DNS points straight at the server

1. Create an A record cloud.example.com → <server public IPv4> (and an AAAA record if the server has IPv6).
2. Optional, if you use them: admin.cloud.example.com and partner.cloud.example.com pointing at the same IP.
3. Run (or re-run) the installer. It sees that the name resolves to the server's own public IP and obtains a Let's Encrypt certificate through the HTTP-01 challenge on port 80.

Mode B: the domain is proxied by Cloudflare

Create the same records with the orange cloud (Proxied). The installer detects that the name resolves only to Cloudflare addresses and switches to Cloudflare mode:

• nginx still listens on 80/443 on your server;
• the visitor's real IP is read from the CF-Connecting-IP header — only for connections coming from Cloudflare's published ranges, so it cannot be forged by anyone else;
• the certificate is obtained through Let's Encrypt (Cloudflare forwards the challenge to your origin); if that is not possible yet, a self-signed origin certificate is created so that "Full" mode works, and a later re-run of the installer upgrades to Let's Encrypt.

You can force this mode with --behind-cloudflare.

::: important Set SSL/TLS mode in Cloudflare In Cloudflare go to SSL/TLS › Overview and select Full (strict) once the installer reports a Let's Encrypt certificate. With a self-signed origin certificate use Full. Flexible will cause redirect loops. :::

TIP

If "Always Use HTTPS" is on, Cloudflare sends the validation request to port 443 of your origin. The installer handles this by creating the temporary self-signed certificate first, then retrying Let's Encrypt.

Check it

dig +short cloud.example.com        # A record (a Cloudflare address in mode B)
curl -I https://cloud.example.com/healthz
sudo certbot certificates           # certificate name, domains and expiry

Certificates renew automatically with certbot's timer. Renewal uses the webroot /var/www/nexcmp-acme, so port 80 must stay reachable (directly or through Cloudflare).

Common problems

Symptom	Cause	Fix
Installer says "DNS … does not point to … (nor to Cloudflare) — skipping nginx/TLS"	DNS record missing, wrong, or not propagated	Fix the record, wait for propagation, re-run the installer.
Browser shows ERR_TOO_MANY_REDIRECTS behind Cloudflare	SSL mode is Flexible	Set Full (strict) (or Full).
Cloudflare error 525/526	Origin certificate rejected	Use Full with a self-signed origin certificate, or Full (strict) with Let's Encrypt.
Visitors all show Cloudflare IPs in logs	Not in Cloudflare mode	Re-run the installer with --behind-cloudflare.

More in Installation errors.