Edge security & TLS

Once your cluster has a public hostname, the OpenResty edge stops behaving like an open IP and becomes a locked-down front door. It answers only the hostnames you configured, hides your real domain from internet scanners, and can refuse any connection that did not arrive through Cloudflare. This page explains each protection, the available TLS modes, and how to add a host firewall for defense in depth.

Host and direct-IP blocking

With a hostname set, the edge only serves requests whose Host header (or TLS SNI) matches a configured hostname. Anything else, including a raw request to the server's IP address or an unknown Host, is dropped with HTTP 444. That is nginx's "close the connection without a response" status, so scanners and bots get nothing back to fingerprint.

This closes the common mistake where hitting the origin IP falls through to the first server block and quietly serves your app. A strict catch-all default_server now owns port 80 and port 443, so unmatched traffic never reaches the application.

Anti-scanning: the decoy certificate

Services like Shodan and Censys crawl the whole IPv4 space, connect to port 443 on every IP, and record the certificate. A real certificate leaks your domain in its Subject Alternative Name (SAN), which lets anyone map an IP straight back to your site.

To prevent that, the catch-all default_server presents a decoy self-signed certificate with a bogus common name and no real SAN. A scanner hitting your IP reads only the decoy, so your true domain never appears in scan results. The real certificate is served exclusively to connections whose SNI matches a configured hostname.

The edge also sets server_tokens off, so responses do not advertise the server version. Together the decoy cert and hidden version give IP scanners nothing useful.

Cloudflare origin lock

When Cloudflare fronts your cluster, all legitimate traffic arrives from Cloudflare's IP ranges. Anyone who discovers your origin IP could otherwise bypass Cloudflare (and its WAF, rate limits, and TLS) by connecting to the origin directly.

The origin lock closes that gap. The edge reads the real connecting IP and refuses any connection that is not from a current Cloudflare range or from loopback, returning 444. Cloudflare's published IPv4 and IPv6 ranges are fetched at render time and cached, with a bundled fallback list in the image so a render never depends on network access.

The lock is on by default for Cloudflare mode and applies to both Flexible (port 80) and Full (port 443). Loopback is always allowed so on-box health checks keep working.

TLS modes

Traffic to the end user is always HTTPS. You pick how TLS is terminated and how the edge presents itself to the origin. Choose the mode that matches how requests reach your host.

Download the active origin certificate

You can view and download the certificate the origin is currently serving from Settings in the console. The download is PEM only and never includes the private key. It shows the certificate along with its fingerprint and expiry, which is handy for uploading the origin certificate into Cloudflare (Full strict) or verifying what the edge presents.

The download is hidden for Cloudflare + Flexible, because in that mode the origin has no certificate (TLS lives entirely at the Cloudflare edge).

Defense in depth: host firewall

The origin lock lives inside the edge. Add a host firewall so unwanted traffic never even reaches OpenResty. When you front the cluster with Cloudflare, restrict ports 80 and 443 to Cloudflare's ranges at the operating-system level.

# For each Cloudflare IPv4 and IPv6 range:
sudo ufw allow from 173.245.48.0/20 to any port 80 proto tcp
sudo ufw allow from 173.245.48.0/20 to any port 443 proto tcp
# ...repeat for every range...

# Then deny direct access from everywhere else:
sudo ufw deny 80/tcp
sudo ufw deny 443/tcp
sudo ufw enable

table inet filter {
  set cloudflare_v4 {
    type ipv4_addr
    flags interval
    elements = { 173.245.48.0/20, 103.21.244.0/22 } # add every Cloudflare range
  }

  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif "lo" accept
    tcp dport { 80, 443 } ip saddr @cloudflare_v4 accept
    # add an ipv6 set + rule for Cloudflare's IPv6 ranges
  }
}

Next steps

• Installation
• Onboarding walkthrough
• Operating the cluster