How can I restrict traffic to only certain (Cloudflare for example) proxies

[toby-griffiths]

I'd like ot restrict access to our server to the Cloudflare proxy servers so that we enforce the DDoS protections it offers.

I've found this article detailing how this can be done, but it adds the IP filter to the handle config block, which I can't see used in the FrankenPHP Caddyfile.

Should I just add this ahead of the php_server diretive, or is there are better place / better way of doing this in FrankenPHP?

[withinboredom]

see: https://frankenphp.dev/docs/config/#:~:text=Using%20the%20php_server%20directive%20is%20equivalent%20to%20this%20configuration%3A

which might help a bit. Frankenphp does not use the handle block.

[toby-griffiths]

Ah, OK. So I would replace the php_server directive with the equivalent router block, and add it there? Thanks. I'll give that a go.

[nickchomey]

You could close all ports with your firewall, and use a cloudflare tunnel. That way the only way for any traffic to come in would be via cloudflare.

[toby-griffiths]

Ah. Nice idea. Thanks.