To terminate SSL traffic at Cloudflare while running Docker containers, you must configure your origin servers to accept unencrypted HTTP from the proxy. This approach simplifies certificate management by removing the need for internal TLS within your container network. By trusting Cloudflare’s encrypted connection and exposing only port 80 or 9080 internally, you ensure that sensitive keys never touch your application code.
Understanding the Architecture
When you place Cloudflare in front of your Docker-hosted services, it acts as a reverse proxy. The client connects to Cloudflare over HTTPS, but the connection between Cloudflare and your server can be either HTTP or HTTPS depending on your configuration. In most standard setups, especially those involving complex routing with tools like Nginx Proxy Manager or Traefik, terminating SSL at the edge is preferred. This means Cloudflare decrypts the traffic and forwards it to your host machine via plain HTTP. Your Docker containers then receive this traffic without needing their own certificates.
This separation of concerns allows you to focus on securing the public-facing endpoint rather than managing individual certificates for every microservice. It also reduces the computational overhead on your host server, as the heavy lifting of TLS handshake decryption is handled by Cloudflare’s global edge network. However, this requires careful configuration to ensure that your internal services correctly identify the original client IP addresses and protocols.
Configuring Cloudflare Settings
The first step is adjusting the encryption mode in your Cloudflare dashboard. Navigate to the SSL/TLS section and select Full or Full (strict). Avoid Flexible mode if you want to maintain some level of security between the proxy and your origin, although Full (strict) requires a valid certificate on your origin which contradicts the goal of no internal certs. For pure HTTP forwarding from Cloudflare, Full mode is sufficient if your origin does not present a cert, but typically you leave the origin open to HTTP requests.
More importantly, you must enable the "Always Use HTTPS" setting in Cloudflare. This forces all visitors to connect via HTTPS before Cloudflare even considers forwarding the request. Additionally, under the SSL/TLS > Edge Certificates tab, ensure that "Automatic HTTPS Rewrites" is enabled. This feature automatically converts any internal links from HTTP to HTTPS, preventing mixed content warnings in browsers. Without this, your web applications might load assets over insecure connections, causing browser errors.
You should also verify that your DNS records are proxied through Cloudflare (orange cloud icon). If they are set to DNS only (gray cloud), SSL termination will not occur, and traffic will go directly to your server, bypassing Cloudflare’s security features entirely.
Docker Container Configuration
Inside your Docker environment, services should bind to localhost or internal bridge networks on non-TLS ports. For example, a web application might listen on port 80 or 8080. Do not expose these ports directly to the internet (0.0.0.0) unless you have a robust external firewall. Instead, use a reverse proxy container like Nginx Proxy Manager or Caddy to handle the routing.
If you are using Nginx Proxy Manager, you can create hosts that point to your backend containers. Set the scheme to HTTP because the incoming connection from Cloudflare is already decrypted. The proxy will then forward the request to your specific container. Ensure that the proxy container trusts the forwarded headers. Look for settings related to X-Forwarded-For and X-Real-IP to preserve client identity.
For applications built with frameworks like Django or Node.js, you may need to adjust the trust proxy settings. In Django, set
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https'). This tells the framework that if it sees this header, it should treat the connection as secure, allowing it to generate correct absolute URLs and enforce secure cookies. Without this, your application might redirect users back to HTTP, breaking the secure flow established by Cloudflare.
Benefits of This Setup
Using Docker containers behind Cloudflare SSL termination offers significant operational advantages. First, it eliminates the complexity of rotating certificates for each service. You do not need to run Let's Encrypt clients inside every container or manage volume mounts for private keys. Second, it enhances security by keeping your origin servers hidden behind Cloudflare’s IP ranges. DDoS attacks are absorbed by Cloudflare’s infrastructure before reaching your Docker host.
Furthermore, this setup simplifies development and deployment. Developers can work locally with simple HTTP configurations without worrying about self-signed certificates. When deploying to production, the same container images work seamlessly because the TLS layer is abstracted away from the application logic. This consistency reduces configuration drift and potential bugs related to certificate expiration or mismatched domains.
Docker and Certificates: Not Creating SSL Certificates Inside Docker explores why avoiding internal certificate generation is a best practice for scalability. Similarly,
Setting up Nginx Traffic Redirect for Subdomains on VPS with Multiple Docker Containers and Cloudflare provides deeper insights into routing strategies for multi-container environments.
Frequently Asked Questions
Can I use Full (strict) mode with no origin certificate?
No, Full (strict) mode requires a valid, trusted SSL certificate on your origin server. If your origin does not present a certificate, the connection will fail. Use Full mode instead, which allows unencrypted connections from Cloudflare to your origin, or install a self-signed certificate and add its CA to Cloudflare’s custom authority list.
How do I verify my real visitor IP address?
Cloudflare adds the
X-Forwarded-For header containing the original client IP. Ensure your web server and application frameworks are configured to read this header. In Nginx, use the
real_ip_header directive. In Docker apps, check the proxy trust settings mentioned earlier to prevent IP spoofing issues.
What happens if Cloudflare goes down?
If Cloudflare experiences an outage, your site becomes inaccessible to users because they rely on Cloudflare’s DNS and edge servers to reach your origin. To mitigate this, consider configuring secondary DNS providers or ensuring your domain’s TTL is low enough to allow quick failover to a backup provider if necessary.
Is it safe to expose port 80 on my Docker host?
Yes, provided you restrict access to Cloudflare’s IP ranges using a firewall like UFW or iptables. Since Cloudflare proxies traffic, exposing port 80 to the entire internet exposes your server to direct attacks. Restricting inbound traffic on port 80 and 443 to Cloudflare’s IP blocks ensures that only authorized proxy traffic reaches your containers.
Why are my assets loading over HTTP despite enabling HTTPS?
This usually occurs because the application generates URLs based on the incoming request scheme. If the proxy strips the HTTPS indicator or the app does not trust the
X-Forwarded-Proto header, it assumes HTTP. Ensure "Automatic HTTPS Rewrites" is on in Cloudflare and that your app correctly interprets forwarded headers as secure.