Hosting your app with Cloudflare

Hosting your app with Cloudflare gives you a global CDN, DDoS protection, a WAF, and a hidden server IP — while DollarDeploy keeps deploying and managing the app on your own server. This guide covers everything you need to set on both sides so the two work together.

This article assumes you have your DNS records in Cloudflare already.

The whole setup is three things: a proxied DNS record in Cloudflare, the hostname on your DollarDeploy app, and one environment variable (DEPLOY_HOSTNAME_MATCH=0) so DollarDeploy skips the server-IP check.

Before you start

• Your domain's nameservers are on Cloudflare (the zone shows Active in the Cloudflare dashboard).
• You have an app ready to be deployed on your server in DollarDeploy, and you know the host's public IP.
• Ports 80 and 443 are open on the host. Port 80 is required — it's how your server answers the Let's Encrypt HTTP-01 challenge.

Step 1 — Add a proxied DNS record in Cloudflare

In Cloudflare → your domain → DNS → Records, add a record pointing at your server:

So for example.com domain and app.example.com hostname, add:

The Orange cloud (Proxied) is what puts Cloudflare in front of your app. With it on, the hostname resolves to Cloudflare's IPs (104.x / 172.67.x), not your server — that's the whole point, and it's also why Step 3 exists.

Grey cloud (DNS only) means traffic goes straight to your server and Cloudflare does nothing but just serve DNS records. If that's all you want, you don't need the rest of this guide.

Step 2 — Set the app hostname in DollarDeploy

Tell DollarDeploy which hostname this app answers on. It must match the record you just created, i.e. app.example.com

Go to Servers => Edit => Hostnames and add your hostname to the host. The Check will not work (because it is using Cloudflare IPs not your server's IPs, but deploying to it will work properly).

DollarDeploy configures the reverse proxy for that hostname on your server, so it serves the same name Cloudflare is serving.

Step 3 — Display hostname match verification during deploy

Add this to app environment:

DEPLOY_HOSTNAME_MATCH=0

Before every deploy, DollarDeploy verifies your hostname's DNS points at the server — a guardrail that catches typos and half-finished DNS changes. With Cloudflare proxying, that check would always fail, because the name now resolves to Cloudflare's IPs instead of your server.

DEPLOY_HOSTNAME_MATCH=0 skips the DNS-match check. Nothing else changes — the app still deploys, gets a certificate, and runs exactly as before.

Step 4 — Choose the right SSL/TLS mode in Cloudflare (Optional)

DollarDeploy issues a real Let's Encrypt certificate on your server, using the HTTP-01 challenge on port 80. Cloudflare forwards /.well-known/acme-challenge/... to your server even with Always Use HTTPS enabled, so issuance works through the proxy.

Because your server already has a valid HTTPS certificate, set Cloudflare → SSL/TLS → Overview to:

• Full (strict) — recommended. Encrypted end to end, with Cloudflare validating your server's certificate.

Avoid Flexible mode — Cloudflare talks to your server over plain HTTP while the browser sees HTTPS. Since DollarDeploy redirects HTTP→HTTPS on your server, Flexible causes a redirect loop.

Step 5 — Deploy

Go to Apps => App => Deploy. DollarDeploy will build and deploy your app normally.

On this deploy DollarDeploy skips the DNS check, reconfigures the reverse proxy for the hostname, and requests the Let's Encrypt certificate. You'll see Successfully deployed certificate for app.example.com in the logs.

Verify it's live and proxied

Use Cloudflare Radar to check your domain: https://radar.cloudflare.com/scan/

Go to the Technology list to see if Cloudflare is detected.

Common gotchas

• Certificate won't issue through the proxy. Rare, but if the HTTP-01 challenge fails, temporarily switch the record to DNS only (grey cloud), run ddc deploy --appId <app-id> to obtain the cert, then flip it back to Proxied. The cert auto-renews on your server.
• Redirect loop / "too many redirects." You're on Cloudflare's Flexible mode. Switch to Full (strict).
• Wildcard subdomains (*.example.com). Cloudflare's free Universal SSL covers the apex and one level of subdomain. Deeper names (a.b.example.com) need an Advanced Certificate.
• Locking the server down. Once you're proxied, only Cloudflare should reach your server on 80/443. Restrict those ports to Cloudflare's IP ranges in your host firewall so no one can bypass the proxy by hitting the raw IP.
• Real visitor IPs. Behind the proxy the client IP arrives in the CF-Connecting-IP header (Cloudflare also sets X-Forwarded-For). Read that in your app if you need the true visitor address.
• WebSockets work through the proxy automatically — no extra configuration.

Live example: this exact setup runs at nextjs-cloudflared.dollardeploy.work — a Next.js app on a Hetzner server, served with Cloudflare in front, deployed with the five steps above.

New to DollarDeploy? You can deploy your first app free — one server, one app, no card — and host it with Cloudflare the same way.