Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
The reasons for having to use their nameservers is probably about getting some data in the process. But DNS queries are quite harmless compared to the MITM issue for the actual traffic.
Traffic proxied via CF uses their TLS certificates. Look up how HTTPS works, and you'll understand that it means the encryption is terminated at Cloudflare.
For the record, CF DNS infrastructure is really solid. For something already public anyway, I'd use their services in a heartbeat. You get some WAF features and can add firewall rules like geoblocking, even on the free tier.
For sensitive data, I probably wouldn't use the proxy service.
Ah, I think I'm starting to understand. Since they ask you to replace the default certificates with Cloudflare specific certificates, in order for these certificates to be authorised, the nameserver needs to be from CF.
But then, if they were to not use their own specific certificate, this would not be a limitation, yes? (As I imagine is the case with the more premium plans). In the case of the premium plans, how do they secure traffic and provide proxy/CDN services with just a CNAME?
A CNAME is just a DNS record that points to another DNS record, technically they could allow it for free users too.
I'd guess the point is they get info on what free users do with their DNS, to help make their paid services more appealing.
No offense, but you might be seriously overthinking this.