Use Cloudflare with Caddy to Scrub Traffic
This article introduces a high-security reverse proxy configuration solution based on Caddy and Cloudflare. The core process uses a script to automatically fetch Cloudflare's latest IPv4 and IPv6 IP ranges and generate a `cloudflare_ips.conf` file containing the trusted proxy list and mandatory mutual TLS (mTLS) verification configuration. This configuration ensures that only Cloudflare nodes holding valid certificates can initiate requests, thereby supporting Full Strict mode. The build script `build_proxy.sh` is responsible for concatenating independent configuration files scattered across different business directories with the base baseline configuration to generate the final Caddyfile, achieving modularization and decoupling of business configurations for easier independent maintenance. During the deployment phase, the actual Cloudflare certificates are mounted into the container via Docker Volume, replacing the temporary certificates used during the build, enabling the service to perform actual work. Ultimately, this architecture implements a triple security mechanism: the use of Cloudflare certificates, strict mTLS client authentication, and trusting only Cloudflare as the front-end proxy. This design ensures extreme security while allowing backend services to transparently obtain the real client IP, balancing security and maintainability.