# BookWyrm + Cloudflare Tunnel (updated) If your Cloudflare tunnel points directly at Gunicorn (`web:8000`), nginx is bypassed entirely. Gunicorn returns HTML for every `/static/` request, and the browser blocks it due to MIME type mismatch and that's why there's no CSS. The fix is to point the tunnel at nginx instead, and disable certbot since Cloudflare handles TLS. ## How the traffic flows Without the fix (tunnel bypasses nginx): ``` Cloudflare → cloudflared → web:8000 (Gunicorn) ✗ ``` With the fix: ``` Cloudflare → cloudflared → nginx:80 → /static/ served directly → everything else → Gunicorn ``` ## 1. Switch nginx to reverse proxy mode Set `NGINX_SETUP=reverse_proxy` in your `.env`: ``` NGINX_SETUP=reverse_proxy ``` BookWyrm's nginx directory includes a `reverse_proxy.conf` specifically for setups where TLS is handled upstream. This makes nginx listen on port 80 only, with no SSL or certbot. (`NGINX_SETUP=http` does **not** work because there is no `http.conf` in the repo.) ## 2. Point your Cloudflare tunnel at nginx, not Gunicorn In your `cloudflared` config (`config.yml`): ```yaml ingress: - hostname: books.yourdomain.com service: http://nginx:80 # not web:8000 - service: http_status:404 ``` If you manage your tunnel through the Cloudflare dashboard, go to **Zero Trust → Networks → Tunnels**, edit the tunnel, and set the service URL to `http://nginx:80`. ## 3. Keep USE_HTTPS set to true Even though the server speaks plain HTTP internally, BookWyrm still needs to know it's behind HTTPS so it generates correct `https://` URLs: ``` USE_HTTPS=true ``` ## 4. Apply the changes You must do a full `down` + `up`, not just `up -d`. If Docker can't find the config file when the container first starts, it creates a directory at that path instead, and nginx falls back to its default welcome page. A full restart clears that: ```bash docker compose down && docker compose up -d ```