# BookWyrm + Cloudflare Tunnel (updated)

If your Cloudflare tunnel points directly at Gunicorn (`web:8000`), nginx is bypassed entirely. Gunicorn returns HTML for every `/static/` request, and the browser blocks it due to MIME type mismatch and that's why there's no CSS.

The fix is to point the tunnel at nginx instead, and disable certbot since Cloudflare handles TLS.

## How the traffic flows

Without the fix (tunnel bypasses nginx):
```
Cloudflare → cloudflared → web:8000 (Gunicorn) ✗
```

With the fix:
```
Cloudflare → cloudflared → nginx:80 → /static/ served directly
                                     → everything else → Gunicorn
```

## 1. Disable SSL in nginx

Set `NGINX_SETUP=http` in your `.env`:

```
NGINX_SETUP=http
```

This switches the built-in nginx to plain HTTP mode. Cloudflare handles HTTPS so yr server only needs to speak plain HTTP internally. certbot will do nothing.

## 2. Point your Cloudflare tunnel at nginx, not Gunicorn

In your `cloudflared` config (`config.yml`):

```yaml
ingress:
  - hostname: books.yourdomain.com
    service: http://nginx:80    # not web:8000
  - service: http_status:404
```

If you manage your tunnel through the Cloudflare dashboard, go to **Zero Trust → Networks → Tunnels**, edit the tunnel, and set the service URL to `http://nginx:80`.

## 3. Keep USE_HTTPS set to true

Even though the server speaks plain HTTP internally, BookWyrm still needs to know it's behind HTTPS so it generates correct `https://` URLs:

```
USE_HTTPS=true
```

## 4. Apply the changes

```bash
docker compose up -d
```
```