Using CloudFlare with NodeBB
-
Fyi I simply replaced
proxy_set_header X-Forwarded-Proto $scheme;
by
proxy_set_header X-Forwarded-Proto https;
in my Nginx config, to make my NodeBB work with CloudFlare, since I am using their automatic SSL certificate (my server receives HTTP requests then, not HTTPS).
Hope this helps
-
So based on what I'm reading and after trying every combination of settings I can find, it seems like not using cloudflare ( at least the free plan). But given that there are people that will DDoS a site "just cause" is there a way to force the downgrade ?
I'd like to add that even after disabling cloudflare I still seem to be having socket io issues.
"GET /socket.io/?EIO=3&transport=polling&t=LlpXxXp HTTP/1.1" 400 23
-
@wolfman2g1 honestly CloudFlare is pretty senseless regarding DDoS protection. With a proper host the chance of a DDoS is close to 0. I am running a top 100K Alexa site without CloudFlare protection (just DNS for faster resolving) and never ran into any issues in the past 4 years.
-
Seams to work great with cloudflare for me
I like the ssl support and DNS gui. But i guess I would not die without it
-
@Jenkler Are you using ssl between your server and cloud flare?
-
@Jenkler looks great man. I'm still trying to understand why I'm getting 400 errors for socket io.
-
I guess you have som configuration issues in nginx!
Here is my config! Maybe this will help you
Server block
server { listen 443 ssl; location @nodebb { proxy_pass http://www-nodebb-se:4567; } location ~ ^\/assets\/(.*) { root /server/nodejs/nodebb.se/www/; try_files /build/public/$1 /public/$1 @nodebb; } location /plugins/ { root /server/nodejs/nodebb.se/www/build/public/; try_files $uri @nodebb; } location / { proxy_pass http://www-nodebb-se:4567; } proxy_http_version 1.1; proxy_redirect off; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header Upgrade $http_upgrade; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-NginX-Proxy true; proxy_set_header X-Real-IP $remote_addr; server_name nodebb.se www.nodebb.se; ssl_certificate /server/nginx/ssl/nodebb.se.crt; ssl_certificate_key /server/nginx/ssl/nodebb.se.key; if ($host != 'www.nodebb.se') { rewrite ^/(.*)$ https://www.nodebb.se/$1 permanent; } }
Global block
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5; ssl_prefer_server_ciphers on; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;
BTW, if someone know any tweeks please advice
And plz explain why!
-
@hek said in Using CloudFlare with NodeBB:
Recommendation
Do NOT use cloudflare (at least not the free plan) on NodeBB when you have a moderate traffic to your forum. Cloudflare seems to silently throttle the traffic resulting in very strange NodeBB behaviour (for some clients) where the simply cut websockets.
The throttled client will see a lot of popups "Looks like your connection to XXX Forum was lost, please wait while we try to reconnect."
In the ngnix error log you will also see lots of:
2017/01/25 09:56:15 [error] 13909#13909: *799654 upstream timed out (110: Connection timed out) while reading response header from upstream, client: xxxxxxxxxxxx.123, server: forum.mysensors.org, request: "GET /socket.io/?EIO=3&transport=polling&t=xxxxx&sid=xxxxxxxxx HTTP/1.1", upstream: "http://127.0.0.1:4568/socket.io/?EIO=3&transport=polling&t=xxxx&sid=xxxxxxx", host: "forum.mysensors.org", referrer: "https://forum.mysensors.org/topic/702/openhab-mqtt-example/2"It has been kind of hellish to find the root cause.
I wonder if anyone was able to find a solution to this? Or is the recommendation still not using NodeBB with CloudFare?
We recently started to use CloudFare (before seeing this topic) and it looks like when the forum traffic is high, we keep losing the connection to the forum, which never happened before CloudFare.
-
@crazycells personally, I believe this to be true. CF will land up causing more issues then it sets out to "resolve".
-
@phenomlab @crazycells That is very weird, we used to recommend against using CF, but then found that the more egregious issues had been resolved.
I will say that if you're using any of their caching technologies (e.g. rocket loader, etc.) then you might see issues where the incorrect cached file may be sent to the wrong users.
-
J julian unpinned this topic on
-
@crazycells said in Using CloudFlare with NodeBB:
We recently started to use CloudFare (before seeing this topic) and it looks like when the forum traffic is high, we keep losing the connection to the forum, which never happened before CloudFare.
I too am experiencing the same issue. Constant disconnects and a ton of socket.io errors. Disabled CF (just for DNS now) and everything is back to normal!
-
@phenomlab Yeah, unfortunately, we could not find any solution, although we worked on this for quite some time...
Then, to have cancer-free life, we gave up on CloudFlare...
-
@crazycells said in Using CloudFlare with NodeBB:
Then, to have cancer-free life, we gave up on CloudFlare...
Which is exactly what I have just done, and now zero issues.
-
@phenomlab said in Using CloudFlare with NodeBB:
@crazycells said in Using CloudFlare with NodeBB:
Then, to have cancer-free life, we gave up on CloudFlare...
Which is exactly what I have just done, and now zero issues.
and everyone lived happily ever after...
-
-
Strange to have issues with CloudFlare/nodeBB
-
@phenomlab Cloudflare Free plans have a 100ish max connections from what I remember to/from WebSocket's. I believe you can submit a support request with Cloudflare to up it to something more but I can't remember all the details. But basically what it comes down to is Cloudflare can't cache that data, and in some applications WebSocket's sends a ton of data which costs quite a bit of bandwidth on Cloudflare's side so they try to avoid it on the free plans by restricting the max number of connections.
Edit: https://developers.cloudflare.com/support/network/using-cloudflare-with-websockets/
Based on some general reports it looks like the Pro plan gives 5x the number of WebSocket connections over the Free plan, and a similar increase from Pro to Business.
-
@tankerkiller125 yes, I read the same article, and they keep revising it. The problem I find is that the disconnects are always socket based, and as a result, the transactional artefact is that notifications don't materialise which can be quite frustrating.
Since no longer using Cloudflare (only in a DNS capacity) proxy, this issue has resolved itself. Cloudflare DNS really does excel and takes some beating, but the "free" plan has a lot of limitations. I've also never been keen on running all of my traffic through one central location as a proxy, so I'm not sorry to be parting company.