Traefik Plugin — Cloudflare

This Traefik plugin corrects X-Forwarded-* headers for requests coming through Cloudflare.

When a request arrives from Cloudflare, the plugin rewrites X-Forwarded-For and X-Forwarded-Proto to reflect the real visitor's address and protocol. To avoid trusting arbitrary sources, the request is first verified against Cloudflare's IP ranges, as recommended by Cloudflare.

Note: Cloudflare's IP ranges are hardcoded in the plugin. This means no outgoing internet connection is required at runtime. However, the IP list may become outdated if a new version of the plugin is not released after Cloudflare changes their ranges.

Mirror

The original content is stored at git.martin-riedl.de and mirrored to Codeberg.

Installation

Since Traefik allows only public plugins from GitHub, we need to use the workaround of so-called local plugins.

For the helm deployment:

1. Add this project as an init container. This copies the plugin files into a volume (emptyDir).

   deployment:
     initContainers:
       - name: install-plugin-cloudflare
         image: git.martin-riedl.de/martinr92/traefik-plugin-cloudflare:v1.x.x # use latest version
         command: ["sh", "-c", 'cp -rv "/plugindata/." "/plugin-mount/"']
         volumeMounts:
           - name: plugin-cloudflare
             mountPath: /plugin-mount
     additionalVolumes:
       - name: plugin-cloudflare
         emptyDir: {}
   

2. Declare the local plugin

   experimental:
     localPlugins:
       cloudflare:
         moduleName: git.martin-riedl.de/martinr92/traefik-plugin-cloudflare
         type: localPath
         volumeName: plugin-cloudflare
         mountPath: /plugins-local/src/git.martin-riedl.de/martinr92/traefik-plugin-cloudflare
         subpath: plugin