# BookWyrm + Cloudflare Tunnel (updated) If your Cloudflare tunnel points directly at Gunicorn (`web:8000`), nginx is bypassed entirely. Gunicorn returns HTML for every `/static/` request, and the browser blocks it due to MIME type mismatch and that's why there's no CSS. The fix is to point the tunnel at nginx instead, and disable certbot since Cloudflare handles TLS. ## How the traffic flows Without the fix (tunnel bypasses nginx): ``` Cloudflare → cloudflared → web:8000 (Gunicorn) ✗ ``` With the fix: ``` Cloudflare → cloudflared → nginx:80 → /static/ served directly → everything else → Gunicorn ``` ## 1. Disable SSL in nginx Set `NGINX_SETUP=http` in your `.env`: ``` NGINX_SETUP=http ``` This switches the built-in nginx to plain HTTP mode. Cloudflare handles HTTPS so yr server only needs to speak plain HTTP internally. certbot will do nothing. ## 2. Point your Cloudflare tunnel at nginx, not Gunicorn In your `cloudflared` config (`config.yml`): ```yaml ingress: - hostname: books.yourdomain.com service: http://nginx:80 # not web:8000 - service: http_status:404 ``` If you manage your tunnel through the Cloudflare dashboard, go to **Zero Trust → Networks → Tunnels**, edit the tunnel, and set the service URL to `http://nginx:80`. ## 3. Keep USE_HTTPS set to true Even though the server speaks plain HTTP internally, BookWyrm still needs to know it's behind HTTPS so it generates correct `https://` URLs: ``` USE_HTTPS=true ``` ## 4. Apply the changes ```bash docker compose up -d ``` ```