Skip to main content

Cloudflare — Access & Security

Security configuration and access control for EchoHuman public infrastructure.

Current Posture​

  • All public domains proxied through Cloudflare (DDoS protection, IP masking)
  • TLS termination at Cloudflare edge + CT101 Caddy (full strict mode)
  • No Cloudflare Access rules currently configured
  • Docsaurus is publicly accessible without authentication

Docsaurus should be password-protected before expanding public documentation.

Option 1: Caddy Basic Auth (Quick)​

On CT101, add basic auth to the Docsaurus route:

pct exec 101 -- nano /etc/caddy/Caddyfile

Add to the docsaurus route:

docsaurus.echohuman.org {
    basicauth {
        admin $2a$14$<bcrypt-hash-here>
    }
    reverse_proxy 192.168.100.220:7030
}

Generate a password hash:

pct exec 101 -- caddy hash-password --plaintext 'yourpassword'

Reload Caddy:

pct exec 101 -- systemctl reload caddy

Advantages: Simple, no external dependencies, works immediately Disadvantages: Single password for all users, no audit trail

Use Cloudflare Zero Trust for better access control:

  1. Enable Cloudflare Zero Trust in dashboard
  2. Create an Access Application for docsaurus.echohuman.org
  3. Set policy: allow specific email addresses or one-time PIN
  4. No changes needed to VM700 or Caddy

Advantages: Per-user access, audit logs, email verification, no password management Disadvantages: Requires Cloudflare Zero Trust subscription

SSL/TLS Configuration​

PropertyValue
ModeFull (strict)
Minimum TLS1.2
CertificateAutomatic (Let's Encrypt via Caddy)
HSTSEnabled (if configured in Caddy)

DDoS Protection​

Cloudflare provides automatic DDoS protection at the edge:

  • Layer 3/4 (network) attacks blocked automatically
  • Layer 7 (application) attacks mitigated by WAF rules
  • Rate limiting available (optional)

Firewall Rules​

At Hetzner level, only ports 80 and 443 should be open to the internet. All other ports blocked.

Verify current Hetzner firewall rules and document here.

Next Steps​

  1. Immediate: Implement password protection for Docsaurus (Option 1 or 2)
  2. Short-term: Document all access policies
  3. Long-term: Consider Cloudflare Access for multi-user scenarios