Update complete. Let me know if I missed anything and thanks for helping.
Hi @skykingjwc, can you please explain more about the advantage of the above tutorial over regular usage of the Cloudflared addon?
It says at the beginning that the advantage is that it âmaintain access though the web interfaceâ. Which web interface has no access when using Cloudflared addon?
many thanks @skykingjwc! just wanted to share that if anyone faced an issue of clients not properly getting the client-certificate prompt I had to disable the HTTP/3 QUIC on cloudflare to make it work smoothly.
Just in case anybody else who has an iPhone comes across this and doesnât know any better, this will NOT work for you as iOS doesnât support it.
Typically if you use the Cloudflared plugin and secure HA with Cloudflare Auth it makes the HA App stop working because the app cannot capture the auth token necessary for auth to work. The browser will work, but the app will not. Perhaps this will be supported at a future date, but currently it is not. Cloudflare tunnels donât provide any security unless you also configure authentication. If configured incorrectly, auth will breaks things. This guide is a way to secure both the HA app and the web interface at the same time. Without additional security, your HA instance is protected only by the HA login screen which means it can be brute forced or could become vulnerable if there is ever a flaw discovered in HA security. When done right, configuring Cloudflare Auth will make it so attackers wonât even be able to access the HA login screen via a browser or use the app without the proper private key certificate, which results in an added layer of projection. Attackers would have to bypass Cloudflare and HA in order to gain access to your instance, which is something thatâs very unlikely to happen.
1 Like
why is step 5 onward needed? I thought WAF rules should block anyone without a cert