Cloudflare in front of Zipper

What this is

Cloudflare’s anycast IPs can sit in front of a customer website. The visitor lands on a Cloudflare PoP. That PoP opens a new TLS session to 191.215.40.237. Zipper’s Global Server nodes stay unicast origin — Zipper Global Server nodes stay the origin.

Do this for a website

Use Cloudflare nameservers for that customer zone. Zipper’s Herald still does not speak UDP 53.

• ▸A/AAAA for www → 191.215.40.237, proxied (orange cloud).
• ▸SSL/TLS: Full (strict). Zipper already presents a publicly trusted certificate.
• ▸Cache Level: Bypass (or Cache Rules that skip /api, /rest, logins). The Crown stays the cache on Zipper.
• ▸Do not orange-cloud MX.

{ "type": "A", "name": "www", "content": "191.215.40.237", "proxied": true }

Never do this for The Cellar

DATABASE_URL is PGWire on db.tinyzipper.com:5432 and pool.tinyzipper.com:6543. Orange cloud is HTTP 80/443. Spectrum would put another vendor on the hatch — Zipper will not treat that as production.

REST on *.cellar.tinyzipper.com sends Cache-Control / CDN-Cache-Control: no-store so a mistaken proxy cannot cache rows. Grey-cloud those names anyway.

• ▸db — DNS-only (grey) A → 191.215.40.237
• ▸pool — DNS-only
• ▸cellar and *.cellar — DNS-only
• ▸Do not enable Spectrum on 5432 or 6543

Visitor IP

Moat, Scepter, and nginx rate-limit zones key by the visitor, not the Cloudflare PoP.

When the TCP peer is a published Cloudflare HTTP proxy range, Zipper reads CF-Connecting-IP. A spoofed CF-Connecting-IP on a direct connection is ignored. Direct visitors still see their own address as X-Real-IP.

psql "postgresql://service:zc_YOUR_SEAL@db.tinyzipper.com:5432/app?sslmode=require"

curl -sS -D- "https://tinyzipper.com/api/v1/cellar/demo" -H "content-type: application/json" -d '{"sql":"SELECT 1"}' | head