this post was submitted on 09 Jan 2024
31 points (94.3% liked)

Selfhosted

40198 readers
1050 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
HybridSarcasm@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
31
What's wrong with using cloudflared? (lemmy.world)
submitted 10 months ago by damnthefilibuster@lemmy.world to c/selfhosted@lemmy.world
33 comments fedilink hide all child comments
 

I read a comment on here some time ago where the person said they were using cloudflared to expose some of their self-hosted stuff to the Internet so they can access it remotely.

I am currently using it to expose my RSS feed reader, and it works out fine. I also like the simplicity of Cloudflare's other offerings.

Any thoughts on why cloudflared is not a good idea? What alternatives would you suggest? How easy/difficult are they to setup?

you are viewing a single comment's thread
view the rest of the comments
[–] Dave@lemmy.nz 64 points 10 months ago (2 children)

I think concerns come in two flavours:

  1. Privacy/security: Cloudflare terminates HTTPS, which means they decrypt your data on their side (e.g. browser to cloudflare section) then re-encrypt for the second part (cloudflare to server). They can therefore read your traffic, including passwords. Depending on your threat model, this might be a concern or it might not. A counterpoint is that Cloudflare helps protect your service from bad actors, so it could be seen to increase security.
  2. Cloudflare is centralised. The sidebar of this community states "A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.", and Cloudflare is for sure a service you don't control, and arguably you're locked into it if you can't access your stuff without it. Some people think Coudflare goes against the ethos of self-hosting.

With that said, you'll find several large lemmy instances (and many small ones) use cloudflare. While you'll easily find people against its use, you'll find many more people in the self-hosted community using it because it's (typically) free and it works. If you want to use it, and you're ok with the above, then go ahead.

[–] lemmyvore@feddit.nl 4 points 10 months ago (1 children)

In addition to the above, most of the percieved advantages of CF are non-existent on the free tier that most people use. Their "DDoS protection" just means they'll drop your tunnel like a hot potato, and their "attack mitigation" on the free tier is a low-effort web app firewall (WAF) that you can replace with a much better and fully customizable self-hosted version.

[–] Dave@lemmy.nz 4 points 10 months ago (1 children)

They explicitly use free DDoS protection as a way to get you in the door, and upsell you on other things. Have you seen them "drop your tunnel like a hot potato"?

Now obviously if their network is at capacity they would prioritise paying customers, but I've never heard of there being an issue with DDoS protection for free users. But I have heard stories of sites enabling Cloudflare while being DDoSed and it resolving the problem.

[–] lemmyvore@feddit.nl 3 points 10 months ago* (last edited 10 months ago) (1 children)

Any stories you've heard about websites enabling CF to survive DDoS were not on the free tier, guaranteed.

Please re-read the description for the free tier. Here's what "DDoS protection" means on free tier:

Customers are not charged for attack traffic ever, period. There’s no penalty for spikes due to attack traffic, requiring no chargeback by the customer.

Will they use some of their capacity to minimize the DDoS effects for their infrastructure? Sure, I mean they have to whether they like or not, since the DNS points at their servers. But will they keep the website going for Joe Freeloader? Don't count on that. The terms are carefully worded to avoid promising anything of the sort.

[–] Dave@lemmy.nz 7 points 10 months ago

They also say "Cloudflare DDoS protection secures websites and applications while ensuring the performance of legitimate traffic is not compromised.", with a tick to indicate this is included in the Free tier.

You are honestly the first person I've heard complain about Cloudflare failing to protect against DDoS attacks. However, I have no doubt that not having Cloudflare, I would fare no better. So still seems worthwhile to me.

[–] Nibodhika@lemmy.world 1 points 10 months ago

There's a third point which is: Things in CloudFlare are publicly accessible, so if you don't put a service on front for authentication and the service you're exposing has no authentication, a weak password or a security issue, you're exposing your server directly to the internet and bad actors can easily find it.

Which is why some services that I don't want to have complicated passwords are only exposed via Tailscale, so only people inside the VPN can access them.