Migration in progress. api.legendary-arena.com and PostgreSQL are moving from Render to a self-hosted DigitalOcean Ubuntu host behind Cloudflare. Render remains rollback-ready until decommission phase.

Cloudflare TLS

Configure origin TLS and edge posture so api traffic is proxied through Cloudflare with strict certificate validation.

Summary

This page owns infra/scripts/21-cloudflare-tls.ps1 .

The script performs host-side setup:

• installs Cloudflare Origin Certificate and key at the origin
• rewrites Nginx site config for HTTPS proxying
• validates and reloads Nginx
• fetches Cloudflare IP ranges and restricts UFW 443 ingress

Dashboard-side settings remain manual and required:

• DNS record for api is proxied
• SSL mode is Full (strict)

Prerequisites

• Nginx baseline configured from nginx reverse proxy step
• UFW enabled
• Cloudflare Origin Certificate and private key issued for api domain

Execute

Set cert and key as environment variables and run:

sudo DOMAIN=api.legendary-arena.com UPSTREAM_PORT=3000 \
  CF_ORIGIN_CERT="$(cat origin.crt)" \
  CF_ORIGIN_KEY="$(cat origin.key)" \
pwsh -File infra/scripts/21-cloudflare-tls.ps1

If cert files are already installed at default paths, run without the cert variables.

Verify

sudo nginx -t
sudo systemctl status nginx --no-pager
sudo ufw status numbered

From Cloudflare-proxied path, validate:

• HTTPS responds successfully
• WebSocket gameplay remains stable
• health endpoints remain green

Important gotcha

Cloudflare Origin Certificates are trusted only through Cloudflare proxy. If you grey-cloud the DNS record, direct browser trust will fail by design.

References

• Plan section 4.3 cloudflare-tls page stub
• Plan section 5.1 TLS and edge posture checklist