Why use a CDN
A CDN (Content Delivery Network) caches static assets at edge nodes closer to visitors, cutting latency, offloading the origin and adding DDoS protection. For sites on a DMIT cloud server, pairing DMIT as the origin with a CDN like Cloudflare is a common acceleration and hardening pattern. This guide covers configuring DMIT as origin behind Cloudflare.
Architecture and prerequisites
- DMIT server already has HTTPS (see HTTPS/SSL Setup)
- Domain DNS can be managed by Cloudflare
- Optionally, restrict origin port 443 to Cloudflare's ranges only
Add the site to Cloudflare
- Add the domain in Cloudflare, then point NS records to the ones provided
- Wait for DNS propagation (minutes to a few hours)
- Add an A record to the DMIT server IP with proxy status "Proxied" (orange cloud)
SSL/TLS mode
Traffic between Cloudflare and the origin also needs encryption. Recommended modes:
| Mode | Meaning | Use |
|---|---|---|
| Flexible | Visitor→CF encrypted, CF→origin plaintext | Origin has no HTTPS (not recommended) |
| Full | Both legs encrypted, cert not verified | Self-signed origin cert |
| Full (strict) | Both legs encrypted, cert verified | Valid origin cert (recommended) |
Choose Full (strict) and keep a valid Let's Encrypt cert on origin (see HTTPS/SSL Setup).
Caching rules
# Cache static assets (Cloudflare rule example)
URL match: example.com/static/*
Set: Cache Level = Cache Everything, Edge TTL = 1 month
# Skip caching for dynamic
URL match: example.com/api/*
Set: Cache Level = BypassFor authenticated pages set Cache-Control: private or Bypass to avoid caching user data.
Origin firewall (allow Cloudflare only)
Restrict the firewall to Cloudflare's IPv4/IPv6 ranges to shrink the origin's attack surface:
# Example: allow only Cloudflare ranges on 443 (keep list updated)
ufw allow from 173.245.48.0/20 to any port 443
ufw allow from 103.21.244.0/22 to any port 443
ufw deny 443Cloudflare's ranges change; sync from their API periodically. More hardening in SSH Hardening.
Performance and SEO gains
- Static assets served nearby, lower TTFB
- Less origin bandwidth, helps Cost Optimisation
- Free tier includes basic DDoS protection and HTTPS
Common issues
Updates not showing due to cache?
Purge the URL in the Cloudflare dashboard, or version static assets (app.v2.js).
Lost real visitor IP?
Enable Nginx's real_ip module to read the CF-Connecting-IP header and restore the real client IP for logs and rate limiting.
Related articles
HTTPS/SSL Setup, Performance Tuning, First Deploy Checklist.
Data checked: 2026-08-18.