Using CloudFlare with NodeBB

AOKP

@wolfman2g1 honestly CloudFlare is pretty senseless regarding DDoS protection. With a proper host the chance of a DDoS is close to 0. I am running a top 100K Alexa site without CloudFlare protection (just DNS for faster resolving) and never ran into any issues in the past 4 years.

wolfman2g1

@AOKP
I think I'm fine with not using cloudflare. At the moment I'm just trying to get the site stable. I'm still getting disconnects even without using Cloudflare.

Mikael Jenkler

Seams to work great with cloudflare for me I like the ssl support and DNS gui. But i guess I would not die without it

wolfman2g1

@Jenkler Are you using ssl between your server and cloud flare?

Mikael Jenkler

Yes I do check out nodebb.se for usecase! Plz notify me if something seams broken! I am using Cloudflares own certs.

wolfman2g1

@Jenkler looks great man. I'm still trying to understand why I'm getting 400 errors for socket io.

Mikael Jenkler

I guess you have som configuration issues in nginx!

Here is my config! Maybe this will help you

Server block

        server
        {
                listen 443 ssl;
                location @nodebb
                {
                        proxy_pass http://www-nodebb-se:4567;
                }
                location ~ ^\/assets\/(.*)
                {
                        root /server/nodejs/nodebb.se/www/;
                        try_files /build/public/$1 /public/$1 @nodebb;
                }
                location /plugins/
                {
                        root /server/nodejs/nodebb.se/www/build/public/;
                        try_files $uri @nodebb;
                }
                location /
                {
                        proxy_pass http://www-nodebb-se:4567;
                }
                proxy_http_version 1.1;
                proxy_redirect off;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $http_host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-NginX-Proxy true;
                proxy_set_header X-Real-IP $remote_addr;

                server_name nodebb.se www.nodebb.se;
                ssl_certificate /server/nginx/ssl/nodebb.se.crt;
                ssl_certificate_key /server/nginx/ssl/nodebb.se.key;

                if ($host != 'www.nodebb.se')
                {
                        rewrite ^/(.*)$ https://www.nodebb.se/$1 permanent;
                }
        }

Global block

      ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

BTW, if someone know any tweeks please advice And plz explain why!

crazycells

@hek said in Using CloudFlare with NodeBB:

Recommendation

Do NOT use cloudflare (at least not the free plan) on NodeBB when you have a moderate traffic to your forum. Cloudflare seems to silently throttle the traffic resulting in very strange NodeBB behaviour (for some clients) where the simply cut websockets.

The throttled client will see a lot of popups "Looks like your connection to XXX Forum was lost, please wait while we try to reconnect."

In the ngnix error log you will also see lots of:
2017/01/25 09:56:15 [error] 13909#13909: *799654 upstream timed out (110: Connection timed out) while reading response header from upstream, client: xxxxxxxxxxxx.123, server: forum.mysensors.org, request: "GET /socket.io/?EIO=3&transport=polling&t=xxxxx&sid=xxxxxxxxx HTTP/1.1", upstream: "http://127.0.0.1:4568/socket.io/?EIO=3&transport=polling&t=xxxx&sid=xxxxxxx", host: "forum.mysensors.org", referrer: "https://forum.mysensors.org/topic/702/openhab-mqtt-example/2"

It has been kind of hellish to find the root cause.

I wonder if anyone was able to find a solution to this? Or is the recommendation still not using NodeBB with CloudFare?

We recently started to use CloudFare (before seeing this topic) and it looks like when the forum traffic is high, we keep losing the connection to the forum, which never happened before CloudFare.

phenomlab

@crazycells personally, I believe this to be true. CF will land up causing more issues then it sets out to "resolve".

julian

@phenomlab @crazycells That is very weird, we used to recommend against using CF, but then found that the more egregious issues had been resolved.

I will say that if you're using any of their caching technologies (e.g. rocket loader, etc.) then you might see issues where the incorrect cached file may be sent to the wrong users.

phenomlab

@crazycells said in Using CloudFlare with NodeBB:

We recently started to use CloudFare (before seeing this topic) and it looks like when the forum traffic is high, we keep losing the connection to the forum, which never happened before CloudFare.

I too am experiencing the same issue. Constant disconnects and a ton of socket.io errors. Disabled CF (just for DNS now) and everything is back to normal!

crazycells

@phenomlab Yeah, unfortunately, we could not find any solution, although we worked on this for quite some time...

Then, to have cancer-free life, we gave up on CloudFlare...

phenomlab

@crazycells said in Using CloudFlare with NodeBB:

Then, to have cancer-free life, we gave up on CloudFlare...

Which is exactly what I have just done, and now zero issues.

crazycells

@phenomlab said in Using CloudFlare with NodeBB:

@crazycells said in Using CloudFlare with NodeBB:

Then, to have cancer-free life, we gave up on CloudFlare...

Which is exactly what I have just done, and now zero issues.

and everyone lived happily ever after...

phenomlab

@crazycells said in Using CloudFlare with NodeBB:

and everyone lived happily ever after...

DownPW

Strange to have issues with CloudFlare/nodeBB

tankerkiller125

@phenomlab Cloudflare Free plans have a 100ish max connections from what I remember to/from WebSocket's. I believe you can submit a support request with Cloudflare to up it to something more but I can't remember all the details. But basically what it comes down to is Cloudflare can't cache that data, and in some applications WebSocket's sends a ton of data which costs quite a bit of bandwidth on Cloudflare's side so they try to avoid it on the free plans by restricting the max number of connections.

Edit: https://developers.cloudflare.com/support/network/using-cloudflare-with-websockets/

Based on some general reports it looks like the Pro plan gives 5x the number of WebSocket connections over the Free plan, and a similar increase from Pro to Business.

phenomlab

@tankerkiller125 yes, I read the same article, and they keep revising it. The problem I find is that the disconnects are always socket based, and as a result, the transactional artefact is that notifications don't materialise which can be quite frustrating.

Since no longer using Cloudflare (only in a DNS capacity) proxy, this issue has resolved itself. Cloudflare DNS really does excel and takes some beating, but the "free" plan has a lot of limitations. I've also never been keen on running all of my traffic through one central location as a proxy, so I'm not sorry to be parting company.

julian

@phenomlab if there are those who are using cloudflare, we do have it in our roadmap to eventually deprecate socket.io and use socket sent events instead.

phenomlab

@julian thanks, although I think this will exhibit the same issues based on limits imposed in the free plan. In my testing, CF was also actually slowing down my site, and since disabling it, the site is noticeably faster.