Legendary Arena Lab

Cloudflare TLS

web

Migration in progress. api.legendary-arena.com and PostgreSQL are moving from Render to a self-hosted DigitalOcean Ubuntu host behind Cloudflare. Render remains rollback-ready until decommission phase.

Cloudflare TLS

Configure origin TLS and edge posture so api traffic is proxied through Cloudflare with strict certificate validation.

Summary

This page owns infra/scripts/21-cloudflare-tls.ps1.

The script performs host-side setup:

  • installs Cloudflare Origin Certificate and key at the origin
  • rewrites Nginx site config for HTTPS proxying
  • validates and reloads Nginx
  • fetches Cloudflare IP ranges and restricts UFW 443 ingress

Dashboard-side settings remain manual and required:

  • DNS record for api is proxied
  • SSL mode is Full (strict)

Prerequisites

  • Nginx baseline configured from nginx reverse proxy step
  • UFW enabled
  • Cloudflare Origin Certificate and private key issued for api domain

Execute

Set cert and key as environment variables and run:

sudo DOMAIN=api.legendary-arena.com UPSTREAM_PORT=3000 \
  CF_ORIGIN_CERT="$(cat origin.crt)" \
  CF_ORIGIN_KEY="$(cat origin.key)" \
pwsh -File infra/scripts/21-cloudflare-tls.ps1

If cert files are already installed at default paths, run without the cert variables.

Verify

sudo nginx -t
sudo systemctl status nginx --no-pager
sudo ufw status numbered

From Cloudflare-proxied path, validate:

  • HTTPS responds successfully
  • WebSocket gameplay remains stable
  • health endpoints remain green

Important gotcha

Cloudflare Origin Certificates are trusted only through Cloudflare proxy. If you grey-cloud the DNS record, direct browser trust will fail by design.

References

  • Plan section 4.3 cloudflare-tls page stub
  • Plan section 5.1 TLS and edge posture checklist