Turkey (Turkish)
Germany (German)
Worldwide (English)
Browser→Cloudflare and Cloudflare→origin are validated separately.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
Turning on Cloudflare proxy does not automatically make TLS correct. Browser→Cloudflare and Cloudflare→origin are two separate TLS hops; origin certificates, proxy mode, firewall and backup storage must align.
Using Flexible SSL sends HTTP to the origin and can create redirect loops or security problems for authenticated applications. Do not terminate HTTPS only at the edge.
For production, prefer Full (strict) and keep a valid certificate on the origin. If you can restrict origin reachability to Cloudflare or a Tunnel path, the attack surface can be reduced further.
For production, prefer Full (strict) and keep a valid certificate on the origin. If you can restrict origin reachability to Cloudflare or a Tunnel path, the attack surface can be reduced further.
Publish Coolify apps safely behind Cloudflare with DNS proxying, Full (strict), origin access, Tunnel alternatives, R2/S3 backups and restore validation.
Browser→Cloudflare and Cloudflare→origin are validated separately.
Mode that validates the origin certificate.
Object storage separates backup copies from the application host.
Some designs connect without directly exposing inbound origin ports.
Edge and origin certificates have separate lifecycles. Troubleshooting without identifying the failing hop wastes time.
| Hop | Certificate | Validation |
|---|---|---|
| Browser → Cloudflare | Edge certificate | Browser/public CA |
| Cloudflare → Coolify origin | Origin/public certificate | Full (strict) |
Proxying can hide a wrong A/AAAA target. Validate direct DNS and certificate behavior before turning on the orange cloud.
dig +short app.example.com Adig +short app.example.com AAAAcurl -vkI https://ORIGIN_IP -H "Host: app.example.com"openssl s_client -connect ORIGIN_IP:443 -servername app.example.com </dev/nullHostname mismatch, expiry or incomplete chains can trigger edge TLS errors. Monitor certificate renewal separately from deployments.
openssl s_client -connect ORIGIN_IP:443 -servername app.example.com -showcerts </dev/nullecho | openssl s_client -connect ORIGIN_IP:443 -servername app.example.com 2>/dev/null | openssl x509 -noout -dates -issuer -subjectIf the origin is globally reachable, attackers may bypass Cloudflare WAF/rate limits. Evaluate firewall rules, Tunnel or authenticated origin mechanisms as appropriate.
An outbound Tunnel can be useful when you do not want inbound 80/443, sit behind NAT or prefer not to publish the origin IP.
| Model | Benefit | Caution |
|---|---|---|
| DNS proxy | Simple, standard | Origin exposure/firewall |
| Tunnel | May avoid inbound ports | Tunnel-agent dependency |
When sending backups to object storage, document lifecycle, encryption, credentials and the actual restore command together.
Edge errors can look similar while causes differ. Isolate DNS, TLS handshake, HTTP redirects and application health in order.
Plan Coolify + Cloudflare origin access and R2/S3 backup topology together on an Eka Sunucu VPS.
Primary documentation and technical references used by this guide.
Continue with related infrastructure and implementation guides.
Coolify Edge & Backup
With a valid origin certificate, prefer Full (strict) for production. Flexible sends HTTP to the origin and is not recommended.
No. Standard proxied DNS with a secured origin works too. Choose Tunnel based on inbound-port and origin-exposure requirements.
R2/S3 is an object-storage target. First create a consistent database dump/PITR artifact, then transfer it securely.
Search engines need the public URL to be accessible and performant; direct public exposure of the origin IP is not an SEO requirement.