Help Needed with Cloudflare Zero Trust, Pages, and Workers for ReactFlux + MiniFlux Setup

Hi everyone,

I'm new to #Cloudflare and have been trying to set up a #SelfHosted project on my #RaspberryPi 500. I'm mostly self-taught, so I apologize if I misunderstand anything or miss important details. Here's my situation:

Current Setup

• I'm running the self-hosted #RSS feed reader #MiniFlux on my Raspberry Pi 500 (#ArchLinuxARM, installed via Pacman).
  
• The setup uses #Caddy as a reverse proxy, a #CloudflareZeroTrust tunnel, and Cloudflare Access for SSO.
  
• My #CloudflareAccess application is configured to allow all origins, methods, and headers. It has a policy that allows specific emails or login methods (e.g., GitHub).
  

What I'm Trying to Do

• I want to deploy ReactFlux, an alternative frontend for MiniFlux, on #CloudflarePages.
  
• Before setting it up fully, I tested the ReactFlux demo with my MiniFlux instance at https://rss.laniecarmelo.tech. However, ReactFlux couldn't log in.
  

Suspected Issue

I believe the issue is caused by Cloudflare Access protection blocking ReactFlux from accessing the MiniFlux API (https://rss.laniecarmelo.tech/v1/*).

What I've Tried So Far

1. I added another hostname (rss.laniecarmelo.tech/v1/*) to my tunnel configuration and created a new Cloudflare Access application with a policy set to "Bypass" for everyone. However, this didn't work—when testing the API endpoint in a private browser window, I'm still asked to sign into Cloudflare.
   
2. I also tried setting up the hostname with "Protect with Access" turned off but got the same results.
   
3. Next, I attempted to use a #CloudflareWorker written in JavaScript to bypass authentication for /v1/*, but it doesn't seem to be doing anything (or isn't being triggered).
   

What I Need Help With

• How can I properly configure Cloudflare so ReactFlux can access the MiniFlux API (/v1/*) while keeping the rest of my MiniFlux instance protected by Cloudflare Access?
  
• I've been stuck on this for a couple of days and would really appreciate any guidance or suggestions!
  

Thanks in advance for your help!

#SelfHosting #ArchLinux #Linux #RSSReader #tech #technology #RaspberryPi #RPi #RPi500 #RaspberryPi500
@selfhosting @selfhost @selfhosted

Help Needed: #CORS and #Cloudflare Access Issues with #Nextflux + #MiniFlux Setup

Hi everyone! I’m struggling with a #SelfHosted setup and could really use some advice from the self-hosting community. Lol I've been trying to figure this out for hours with no luck. Here’s my situation:

Setup

• MiniFlux: Running in #Docker on a #RaspberryPi500 (#Stormux, based on #ArchLinuxARM).
• Nextflux: Hosted on Cloudflare Pages.
• Reverse Proxy: #Caddy (installed via AUR).
• Cloudflare Access: Enabled for security and SSO.
• Cloudflared: Also installed via AUR.
• CORS Settings in Cloudflare Access: Configured to allow all origins, methods, and headers.

What’s Working

• MiniFlux is accessible from my home network after removing restrictive CORS settings in both Caddy and MiniFlux.
• Nextflux is properly deployed on Cloudflare Pages.

The Problem

Nextflux cannot connect to MiniFlux due to persistent CORS errors and authentication issues with Cloudflare Access. Here are the errors I’m seeing in the browser console:

1. CORS Error:Access to fetch at 'https://rss.laniecarmelo.tech/v1/me' from origin 'https://nextflux.laniecarmelo.tech' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

2. Cloudflare Access Redirection:

   Request redirected to 'https://lifeofararebird.cloudflareaccess.com/cdn-cgi/access/login/rss.laniecarmelo.tech'.
   

3. Failed to Fetch:

   Failed to fetch: TypeError: Failed to fetch.
   

What I’ve Tried

1. Service Token Authentication:

   • Generated a service token in Cloudflare Access for Nextflux.
   • Added CF-Access-Client-Id and CF-Access-Client-Secret headers in Caddy for rss.laniecarmelo.tech.
   • Updated Cloudflare Access policies to include a bypass rule for this service token.

2. CORS Configuration:

   • Tried permissive settings (Access-Control-Allow-Origin: *) in both Caddy and MiniFlux.
   • Configured Cloudflare Access CORS settings to allow all origins, methods, and headers.

3. Policy Adjustments:

   • Created a bypass policy for my home IP range and public IP.
   • Added an "Allow" policy for authenticated users via email/login methods.

4. Debugging Logs:

   • Checked Cloudflared logs, which show requests being blocked due to missing access tokens (AccessJWTValidator errors).

Current State

Despite these efforts:

• Requests from Nextflux are still being blocked by Cloudflare Access or failing due to CORS issues.
• The browser console consistently shows "No 'Access-Control-Allow-Origin' header" errors.

Goals

1. Allow Nextflux (hosted on Cloudflare Pages) to connect seamlessly to MiniFlux (behind Cloudflare Access).
2. Maintain secure access to MiniFlux for other devices (e.g., my home network or mobile devices).

My Environment

• Raspberry Pi 500 running Arch Linux ARM.
• Both Caddy and Cloudflared are installed via AUR packages.
• MiniFlux is running in Docker with the following environment variables:CLOUDFLARE_SERVICE_AUTH_ENABLED=trueCLOUDFLARE_CLIENT_ID=<client-id>CLOUDFLARE_CLIENT_SECRET=<client-secret>

Relevant Logs

From cloudflared:

ERR error="request filtered by middleware handler (AccessJWTValidator) due to: no access token in request"

From the browser console:

Access to fetch at 'https://rss.laniecarmelo.tech/v1/me' has been blocked by CORS policy.

Questions

1. Is there a better way to configure CORS for this setup?
2. Should I be handling authentication differently between Nextflux and MiniFlux?
3. How can I ensure that requests from Nextflux include valid access tokens?

Any help or advice would be greatly appreciated!