Is Kamal 2 + Cloudflare Tunnel + SSL on kamal_proxy possible?

[AlexB52]

Hi everyone,

I'm hosting a demo Rails 8 application on an old PC at home and using Cloudflare tunnel to expose it publicly without port forwarding. My understanding is that the tunnel already acts as a reverse proxy. Normally, you'd point a domain to a specific IP and port where the application is running. For example, I have FreshRSS running on a 8300 port and expose it by mapping my domain to http://192.168.1.97:8300

For multiple apps deployed with Kamal 2 on a single box, I point all domains to kamal_proxy instead of the apps directly, and let the proxy route requests. Right now, I have it working by pointing all domains to http://192.168.1.97:80, with SSL terminated at Cloudflare Tunnel. My Kamal proxy config looks like this:

proxy:
  ssl: false
  host: app.domain.com

I’ve tried enabling SSL on kamal_proxy (using Let’s Encrypt, Cloudflare origin certs, etc.), but haven’t found a working configuration.

Questions:

• Has anyone managed to get Cloudflare Tunnel + Kamal 2 with kamal_proxy SSL enabled and working?
• Should I leave SSL termination at Cloudflare Tunnel and skip configuring SSL in kamal_proxy?

Thanks for your help

[brendon]

I think you can safely turn ssl off in Rails and in kamal-proxy. I usually use the following config:

  # Assume all access to the app is happening through a SSL-terminating reverse proxy.
  config.assume_ssl = true

  # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
  config.force_ssl = false

Then let Cloudflare handle the SSL for you. You need to pick a particular SSL mode in Cloudflare though and it won't be 'Full' because it'll be talking to your proxy via http.

[AlexB52]

Thanks @brendon
I haven't touched the default config in production.rb file. Both settings are currently set to true on the test app. I'm reluctant to turn more things off unless necessary. What happens when you access your app through http://? Does Cloudflare force the use of https.

[brendon]

Yes, it will upgrade the connection to https for you. It's just the connection between CloudFlare and your server that will be http and that's ok if that connection is on a private network (i.e. your tunnel).

[mrkhalidj]

would love to read more about the best way to accomplish this.

I'm currently in the same situation and wondering if using 'flexible' mode in Cloudflare combined with the config changes @brendon mentioned would be a good way to go security-wise.