# BookWyrm + Cloudflare Tunnel (updated)

If your Cloudflare tunnel points directly at Gunicorn (`web:8000`), nginx is bypassed entirely. Gunicorn returns HTML for every `/static/` request, and the browser blocks it due to MIME type mismatch and that's why there's no CSS.

The fix is to point the tunnel at nginx instead, and disable certbot since Cloudflare handles TLS.

## How the traffic flows

Without the fix (tunnel bypasses nginx):
```
Cloudflare → cloudflared → web:8000 (Gunicorn) ✗
```

With the fix:
```
Cloudflare → cloudflared → nginx:80 → /static/ served directly
                                     → everything else → Gunicorn
```

## 1. Switch nginx to reverse proxy mode

Set `NGINX_SETUP=reverse_proxy` in your `.env`:

```
NGINX_SETUP=reverse_proxy
```

BookWyrm's nginx directory includes a `reverse_proxy.conf` specifically for setups where TLS is handled upstream. This makes nginx listen on port 80 only, with no SSL or certbot. (`NGINX_SETUP=http` does **not** work because there is no `http.conf` in the repo.)

## 2. Point your Cloudflare tunnel at nginx, not Gunicorn

In your `cloudflared` config (`config.yml`):

```yaml
ingress:
  - hostname: books.yourdomain.com
    service: http://nginx:80    # not web:8000
  - service: http_status:404
```

If you manage your tunnel through the Cloudflare dashboard, go to **Zero Trust → Networks → Tunnels**, edit the tunnel, and set the service URL to `http://nginx:80`.

## 3. Keep USE_HTTPS set to true

Even though the server speaks plain HTTP internally, BookWyrm still needs to know it's behind HTTPS so it generates correct `https://` URLs:

```
USE_HTTPS=true
```

## 4. Apply the changes

You must do a full `down` + `up`, not just `up -d`. If Docker can't find the config file when the container first starts, it creates a directory at that path instead, and nginx falls back to its default welcome page. A full restart clears that:

```bash
docker compose down && docker compose up -d
```