The parts of Cloudflare you use when you run your own infrastructure — DNS and proxy status, deploying to Workers, and replacing inbound firewall rules with a tunnel.
Three articles, about two hours. They cover the Cloudflare features a developer running their own servers reaches for, and skip the enterprise surface entirely.
Start with DNS and TLS even if the tunnel is what brought you here. Proxy status and encryption mode are the two concepts everything else builds on, and getting them wrong produces errors that look like origin problems.
The Workers article stands alone — it is about not having an origin server at all — so read it whenever it becomes relevant rather than in strict order.
Read in order. Ticking a lesson stores your progress in this browser only.
Create the A record, pick the right proxy status, set the SSL mode to Full (strict) and lock the origin so only Cloudflare can reach it — plus what errors 521, 522, 525 and 526 actually mean.
The two settings that cause most Cloudflare-related outages.
Ship a static or server-rendered Astro site to Cloudflare Workers with Wrangler — adapter setup, wrangler.jsonc, nodejs_compat, secrets, custom domains and the errors you hit on the first deploy.
Wrangler, adapters and the compatibility flags that trip up the first deploy.
Expose Docker services through Cloudflare with no inbound ports open — cloudflared plus Traefik, the forwarded-header setting that trips people up, and how to verify the firewall is closed.
Advanced. Assumes you are comfortable with Docker networking.
Create the A record, pick the right proxy status, set the SSL mode to Full (strict) and lock the origin so only Cloudflare can reach it — plus what errors 521, 522, 525 and 526 actually mean.
Ship a static or server-rendered Astro site to Cloudflare Workers with Wrangler — adapter setup, wrangler.jsonc, nodejs_compat, secrets, custom domains and the errors you hit on the first deploy.
Expose Docker services through Cloudflare with no inbound ports open — cloudflared plus Traefik, the forwarded-header setting that trips people up, and how to verify the firewall is closed.