> For the complete documentation index, see [llms.txt](https://www.trentbauer.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.trentbauer.com/guides/installation-guides/pelican/cloudflare.md).

# Cloudflare

To make DDNS, Dockflare and Cloudflared work we need some data from Cloudflare

#### Before continuing, please follow

1. [Configure Domain](/guides/other-guides/cloudflare/configure-domain.md) and
2. [Cloudflare Zero Trust](/guides/other-guides/cloudflare/cloudflare-zero-trust.md)

{% hint style="danger" %}
Please ensure you set the [Cloudflare Zero Trust](/guides/other-guides/cloudflare/cloudflare-zero-trust.md#set-up-wildcard-application) - if you do not, external parties will be able to access and modify your Dockflare settings - this is a major security risk - as well as your database contents if you enable the Adminer proxy link
{% endhint %}

### Generate your API key

This API key will be used for Dockflare, Dynamic DNS and Crowdsec

1. Navigate to <https://dash.cloudflare.com/profile/api-tokens>
2. Click Create Token > Custom Token
3. Name your token Pelican, and set the below&#x20;
   1. permissions

      <table><thead><tr><th width="148"></th><th width="357"></th><th></th></tr></thead><tbody><tr><td>Account</td><td>Cloudflare Tunnel</td><td>Edit</td></tr><tr><td>Account</td><td>Account Filter Lists</td><td>Edit</td></tr><tr><td>Account</td><td>Firewall Access Rules</td><td>Edit</td></tr><tr><td>Account</td><td>Account Settings</td><td>Read</td></tr><tr><td>Account</td><td>Access: Apps and Policies</td><td>Edit</td></tr><tr><td>User</td><td>User Details</td><td>Read</td></tr><tr><td>Zone</td><td>DNS</td><td>Read</td></tr><tr><td>Zone</td><td>Firewall Services</td><td>Edit</td></tr><tr><td>Zone</td><td>Zone</td><td>Edit</td></tr></tbody></table>
   2. Account Resources

      | Field   | Data        |
      | ------- | ----------- |
      | Include | All Account |
   3. Zone Resources\
      \&#xNAN;*You can have additional domains*

      |         |               |             |
      | ------- | ------------- | ----------- |
      | Include | Specific Zone | Your Domain |
   4. Click on Continue to Summary
4. Save your API key to your notepad, `CF_APITOKEN=`

### Get your Account ID

1. Browse to <https://dash.cloudflare.com/>
2. Next to your name, click on the 3 dots and select Copy Account ID
3. Save to your notepad, `CF_ACCOUNTID=`

### Get your Zone ID

1. Browse to <https://dash.cloudflare.com/?to=/:account/home/domains>&#x20;
2. Click manage next to your domain
3. Scroll down and locate "API" on the right
4. Save  your Zone ID to your notepad, `CF_ZONE_ID=`

## Security rules

Configure some security rules to reduce the risk of malicious actors accessing your domain

1. Navigate to <https://dash.cloudflare.com/>
2. Select your domain
3. On the left, click expand Security and select rules
4. Click on create rule > custom rule
   1. Next to Expression Preview, click on 'edit expression' to get the free text field
5. Create a rule for each of the below

### Block bots

This policy will show a Captcha challenge to any IPs suspected of botting

<table><thead><tr><th width="229">Field</th><th>Data</th></tr></thead><tbody><tr><td>Rule Name</td><td>Block Bots</td></tr><tr><td>Expression</td><td>(cf.client.bot)</td></tr><tr><td>Choose action</td><td>Managed Challenge</td></tr><tr><td>Place at</td><td>First</td></tr></tbody></table>

### Challenge Threat Score

These IPs are potentially malicious. These addresses will be prompted for Captcha

<table><thead><tr><th width="229">Field</th><th>Data</th></tr></thead><tbody><tr><td>Rule Name</td><td>Challenge Threat Score</td></tr><tr><td>Expression</td><td>(cf.threat_score gt 10)</td></tr><tr><td>Choose action</td><td>Managed Challenge</td></tr><tr><td>Place at</td><td>Custom - after 'Block Bots'</td></tr></tbody></table>

### Block Threat Score

These IPs are very likely to be malicious. These addresses will be blocked

<table><thead><tr><th width="229">Field</th><th>Data</th></tr></thead><tbody><tr><td>Rule Name</td><td>Challenge Threat Score</td></tr><tr><td>Expression</td><td>(cf.threat_score gt 50)</td></tr><tr><td>Choose action</td><td>Block</td></tr><tr><td>Place at</td><td>Custom - after 'Challenge Threat Score'</td></tr></tbody></table>

{% hint style="info" %}
An additional rule will be created by the Crowdsec CF Bouncer container after the Compose file is ran
{% endhint %}