# Template: copy to your real vhost name (e.g. /etc/caddy/conf.d/<your-domain>.caddy)
# and replace xp.example.com with your site domain throughout.
# Official source lists checked on 2026-10-02:
# https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6
# Match the immediate TCP peer; forwarded headers never grant access.
(xgift-cloudflare-source) {
    @cloudflare {
        remote_ip 173.245.48.0/20 103.21.244.0/22 103.22.200.0/22 103.31.4.0/22 141.101.64.0/18 108.162.192.0/18 190.93.240.0/20 188.114.96.0/20 197.234.240.0/22 198.41.128.0/17 162.158.0.0/15 104.16.0.0/13 104.24.0.0/14 172.64.0.0/13 131.0.72.0/22 2400:cb00::/32 2606:4700::/32 2803:f800::/32 2405:b500::/32 2405:8100::/32 2a06:98c0::/29 2c0f:f248::/32
        header CF-Connecting-IP *
    }
}

http://xp.example.com {
    import xgift-cloudflare-source
    handle @cloudflare {
        redir https://xp.example.com{uri} permanent
    }
    handle {
        respond "Forbidden" 403
    }
}

xp.example.com {
    import xgift-cloudflare-source
    encode zstd gzip
    header Strict-Transport-Security "max-age=31536000"
    handle @cloudflare {
        reverse_proxy 127.0.0.1:8787 {
            header_up X-Real-IP {http.request.header.CF-Connecting-IP}
        }
    }
    handle {
        respond "Forbidden" 403
    }
}