Using CloudFlare with NodeBB

[vstoykov]

I made it to work.

I tried to post more details here, but I got error:

Error

Post content was flagged as spam by Akismet.com

Here is my original post: http://pastebin.com/5s9jUe6N

Also, Pastebin gave me similar error and I needed to solve a captcha...

[julian]

@vstoykov Hm, that is quite interesting, so you need to manually set cookieDomain to .example.com with the leading period for it to work? I was always under the impression that it was optional...

[antoine]

Fyi I simply replaced

proxy_set_header X-Forwarded-Proto $scheme;

by

proxy_set_header X-Forwarded-Proto https;

in my Nginx config, to make my NodeBB work with CloudFlare, since I am using their automatic SSL certificate (my server receives HTTP requests then, not HTTPS).

Hope this helps

[wolfman2g1]

So based on what I'm reading and after trying every combination of settings I can find, it seems like not using cloudflare ( at least the free plan). But given that there are people that will DDoS a site "just cause" is there a way to force the downgrade ?

I'd like to add that even after disabling cloudflare I still seem to be having socket io issues.

"GET /socket.io/?EIO=3&transport=polling&t=LlpXxXp HTTP/1.1" 400 23

[AOKP]

@wolfman2g1 honestly CloudFlare is pretty senseless regarding DDoS protection. With a proper host the chance of a DDoS is close to 0. I am running a top 100K Alexa site without CloudFlare protection (just DNS for faster resolving) and never ran into any issues in the past 4 years.

[wolfman2g1]

@AOKP
I think I'm fine with not using cloudflare. At the moment I'm just trying to get the site stable. I'm still getting disconnects even without using Cloudflare.

[Jenkler]

Seams to work great with cloudflare for me I like the ssl support and DNS gui. But i guess I would not die without it

[wolfman2g1]

@Jenkler Are you using ssl between your server and cloud flare?

[Jenkler]

Yes I do check out nodebb.se for usecase! Plz notify me if something seams broken! I am using Cloudflares own certs.

[wolfman2g1]

@Jenkler looks great man. I'm still trying to understand why I'm getting 400 errors for socket io.

[Jenkler]

I guess you have som configuration issues in nginx!

Here is my config! Maybe this will help you

Server block

        server
        {
                listen 443 ssl;
                location @nodebb
                {
                        proxy_pass http://www-nodebb-se:4567;
                }
                location ~ ^\/assets\/(.*)
                {
                        root /server/nodejs/nodebb.se/www/;
                        try_files /build/public/$1 /public/$1 @nodebb;
                }
                location /plugins/
                {
                        root /server/nodejs/nodebb.se/www/build/public/;
                        try_files $uri @nodebb;
                }
                location /
                {
                        proxy_pass http://www-nodebb-se:4567;
                }
                proxy_http_version 1.1;
                proxy_redirect off;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $http_host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-NginX-Proxy true;
                proxy_set_header X-Real-IP $remote_addr;

                server_name nodebb.se www.nodebb.se;
                ssl_certificate /server/nginx/ssl/nodebb.se.crt;
                ssl_certificate_key /server/nginx/ssl/nodebb.se.key;

                if ($host != 'www.nodebb.se')
                {
                        rewrite ^/(.*)$ https://www.nodebb.se/$1 permanent;
                }
        }

Global block

      ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;

BTW, if someone know any tweeks please advice And plz explain why!

[crazycells]

@hek said in Using CloudFlare with NodeBB:

Recommendation

Do NOT use cloudflare (at least not the free plan) on NodeBB when you have a moderate traffic to your forum. Cloudflare seems to silently throttle the traffic resulting in very strange NodeBB behaviour (for some clients) where the simply cut websockets.

The throttled client will see a lot of popups "Looks like your connection to XXX Forum was lost, please wait while we try to reconnect."

In the ngnix error log you will also see lots of:
2017/01/25 09:56:15 [error] 13909#13909: *799654 upstream timed out (110: Connection timed out) while reading response header from upstream, client: xxxxxxxxxxxx.123, server: forum.mysensors.org, request: "GET /socket.io/?EIO=3&transport=polling&t=xxxxx&sid=xxxxxxxxx HTTP/1.1", upstream: "http://127.0.0.1:4568/socket.io/?EIO=3&transport=polling&t=xxxx&sid=xxxxxxx", host: "forum.mysensors.org", referrer: "https://forum.mysensors.org/topic/702/openhab-mqtt-example/2"

It has been kind of hellish to find the root cause.

I wonder if anyone was able to find a solution to this? Or is the recommendation still not using NodeBB with CloudFare?

We recently started to use CloudFare (before seeing this topic) and it looks like when the forum traffic is high, we keep losing the connection to the forum, which never happened before CloudFare.

[phenomlab]

@crazycells personally, I believe this to be true. CF will land up causing more issues then it sets out to "resolve".

[julian]

@phenomlab @crazycells That is very weird, we used to recommend against using CF, but then found that the more egregious issues had been resolved.

I will say that if you're using any of their caching technologies (e.g. rocket loader, etc.) then you might see issues where the incorrect cached file may be sent to the wrong users.