Skip to main content

Recommended optional Cloudflare services

Cloudflare is a useful choice for DNS, HTTPS, optional Tunnel ingress and R2 storage. It is optional: NuSaaS also runs with a conventional HTTPS proxy and local storage. Use your own account, domains, buckets and credentials. Review current free-plan limits and usage charges rather than assuming every service is free or unlimited. Registrar offers at-cost registration and renewal for supported domains.

Cloudflare Tunnel​

Tunnel connects outward from your server. It does not host Laravel, MySQL, queues or Reverb for you.

For the revised published distribution, obtain the matching docker-compose.cloudflare.yml overlay from your installer bundle. The guided installer assumes direct Caddy ingress; configure Tunnel manually:

  1. Create a remotely managed tunnel in your own Cloudflare account.
  2. Put its token in secrets/cloudflared-token, readable only by the operator. Do not paste it into Compose, browser settings or support chat.
  3. Set CLOUDFLARED_IMAGE in .env to a reviewed tag/digest.
  4. Add app/API/WebSocket public-hostname routes to the tunnel: http://web:4001, http://api:4000, http://ws:8083 respectively.
  5. Create the dashboard-provided DNS CNAME records targeting your tunnel UUID. Do not reuse NuSaaS tunnel targets.
  6. Match application origins, trusted proxies, CORS and Reverb settings to these public domains.
# Run from the configured installation directory.
docker compose -f docker-compose.yml -f docker-compose.cloudflare.yml config --quiet
docker compose -f docker-compose.yml -f docker-compose.cloudflare.yml up -d

For API-domain WebSockets instead of a separate hostname, configure a more-specific /app/* route to ws:8083 before the API catch-all and keep the browser Reverb host on the API domain.

The overlay disables the normal Caddy service through a profile and publishes no inbound application ports. If switching a running direct-Caddy installation, stop the old proxy explicitly first; changing profiles does not reliably remove an existing container. Keep the same Compose files for subsequent updates/status commands. The generated base-only update script needs adaptation before use with overlays; do not run it unchanged.

If using your own Evolution overlay, add whatsapp.yourdomain.com → http://evolution:8080. Keep webhook paths accessible without interactive Cloudflare Access/login challenges; callbacks authenticate with their generated token. Restrict gateway management access separately and never expose database/cache ports.

R2 uploads and backups​

R2 supports S3-compatible access. For uploads, set FILESYSTEM_DISK=s3, your bucket-scoped AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, AWS_BUCKET, region auto, AWS_ENDPOINT=https://ACCOUNT_ID.r2.cloudflarestorage.com and AWS_USE_PATH_STYLE_ENDPOINT=true. Configure AWS_URL only for an intentional object-serving domain; private objects need authenticated delivery. Validate representative upload/download workflows and bucket CORS before moving production files. Changing the disk does not migrate existing uploads.

Backups use a separate private bucket and credentials: BACKUP_R2_ENABLED, BACKUP_R2_BUCKET, BACKUP_R2_ENDPOINT, BACKUP_R2_ACCESS_KEY_ID, BACKUP_R2_SECRET_ACCESS_KEY, archive password and recovery key. Keep recovery secrets outside the bucket in an offline recovery store. Do not assume upload configuration enables backups. See Backups.

Pages and Workers​

Pages can serve a compiled frontend as an alternative to the frontend container. Source access is not included in this image-only distribution: this is a maintainer-prepared static deployment option, not an instruction to clone our private repository. Only compiled public assets should be uploaded, with final browser settings and no runtime placeholders or secrets. The self-hosted build profile must remain enabled and billing disabled. There is no console site to deploy.

Workers may support optional edge workflows, but the current ERP still requires the server services listed above. D1, not “D2”, is Cloudflare's SQLite-based service accessed through Workers/API bindings; NuSaaS has no production D1 database adapter. Keep MySQL for ERP data. See D1 documentation.