Cloudflare Essentials
Three articles covering the Cloudflare surface most developers actually touch — pointing a domain at an origin, deploying to Workers, and replacing inbound ports with a tunnel.
Cloudflare is several products that happen to share a dashboard. This series covers the three that a developer running their own infrastructure will use first.
Part one connects a domain to a server you already have, and explains the two settings that cause almost every 5xx error people blame on Cloudflare. Part two moves an application onto Workers so there is no origin server at all. Part three closes the loop: keeping the origin, but removing every inbound port with a tunnel.
Read part one first even if the tunnel is what you came for. The proxy status and encryption mode concepts it covers apply to everything else.
-
How to Point a Cloudflare Domain at Your VPS
Create the A record, pick the right proxy status, set the SSL mode to Full (strict) and lock the origin so only Cloudflare can reach it — plus what errors 521, 522, 525 and 526 actually mean.
-
How to Deploy an Astro Site to Cloudflare Workers
Ship a static or server-rendered Astro site to Cloudflare Workers with Wrangler — adapter setup, wrangler.jsonc, nodejs_compat, secrets, custom domains and the errors you hit on the first deploy.
-
How to Run Cloudflare Tunnel in Front of Traefik
Expose Docker services through Cloudflare with no inbound ports open — cloudflared plus Traefik, the forwarded-header setting that trips people up, and how to verify the firewall is closed.