40 lines
1.5 KiB
Caddyfile
40 lines
1.5 KiB
Caddyfile
# Template: copy to your real vhost name (e.g. /etc/caddy/conf.d/<your-domain>.caddy)
|
|
# and replace xp.example.com with your site domain throughout.
|
|
# Official source lists checked on 2026-10-02:
|
|
# https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6
|
|
# Match the immediate TCP peer; forwarded headers never grant access.
|
|
(xgift-cloudflare-source) {
|
|
@cloudflare {
|
|
remote_ip 173.245.48.0/20 103.21.244.0/22 103.22.200.0/22 103.31.4.0/22 141.101.64.0/18 108.162.192.0/18 190.93.240.0/20 188.114.96.0/20 197.234.240.0/22 198.41.128.0/17 162.158.0.0/15 104.16.0.0/13 104.24.0.0/14 172.64.0.0/13 131.0.72.0/22 2400:cb00::/32 2606:4700::/32 2803:f800::/32 2405:b500::/32 2405:8100::/32 2a06:98c0::/29 2c0f:f248::/32
|
|
header CF-Connecting-IP *
|
|
}
|
|
}
|
|
|
|
http://xp.example.com {
|
|
import xgift-cloudflare-source
|
|
handle @cloudflare {
|
|
redir https://xp.example.com{uri} permanent
|
|
}
|
|
handle {
|
|
respond "Forbidden" 403
|
|
}
|
|
}
|
|
|
|
xp.example.com {
|
|
import xgift-cloudflare-source
|
|
encode zstd gzip
|
|
header Strict-Transport-Security "max-age=31536000"
|
|
handle @cloudflare {
|
|
reverse_proxy 127.0.0.1:8787 {
|
|
# Let existing queue polls survive a short backend restart.
|
|
lb_try_duration 30s
|
|
lb_try_interval 250ms
|
|
lb_retry_match method GET
|
|
header_up X-Real-IP {http.request.header.CF-Connecting-IP}
|
|
}
|
|
}
|
|
handle {
|
|
respond "Forbidden" 403
|
|
}
|
|
}
|