# Cloudflare deployment profile

Use Cloudflare only if this is the chosen domain's proxy. Enable Full (strict) TLS to the origin; keep a valid origin certificate and redirect HTTP to HTTPS. Close direct origin ingress except the currently published Cloudflare proxy ranges and the intended operator path. Fetch those ranges from [Cloudflare's official list](https://www.cloudflare.com/ips/) when configuring the host; no static copied IP ranges are bundled here.

Configure WAF and rate limits for abuse patterns with a measured baseline. Telegram webhook traffic cannot complete interactive browser challenges. Exempt only the exact configured webhook route from interactive challenges while retaining the application's secret-header validation and deduplication. Do not broadly bypass WAF for `/api` or `/admin`.

Bypass CDN caching for `/api/*`, `/admin`, authenticated responses and health/readiness responses. Never cache responses carrying Set-Cookie. Cache versioned public assets only after checking the deployment's asset URLs and cache invalidation behavior. Apply request/body/time limits and review limits against the 5 MiB image-upload setting.

When using `CF-Connecting-IP`, configure Nginx `set_real_ip_from` with only current trusted proxy CIDRs and `real_ip_header CF-Connecting-IP`. The supplied Nginx template is direct TLS ingress and intentionally does not trust this header by default. Never trust it from arbitrary internet clients. Overwrite X-Forwarded-For toward Node after real-IP processing; verify forged headers over both direct and proxied paths. [Nginx real IP documentation](https://nginx.org/en/docs/http/ngx_http_realip_module.html) explains the trust directives.

Record WAF decisions, 429/5xx rates and origin latency. Test Mini App/Web iframe loading, CSP, cookies, webhook registration and admin login after rule changes. Cloudflare account changes are not performed by these source templates.