Cloudflare no longer support mod_cloudflare. Need to switch to mod_remoteip?

[deggertsen]

What type of report is this:
Bug report

Description:

Getting this today in Elastic Beanstalk. It seems the perhaps Cloudflare has removed support for this mod and you can't download that file from their site anymore.

Application deployment failed at 2020-04-15T17:04:02Z with exit status 8 and error: command 20_cloudflare in .ebextensions/20_cloudflare.config failed.

--2020-04-15 17:00:57-- https://www.cloudflare.com/static/misc/mod_cloudflare/mod_cloudflare.c
Resolving www.cloudflare.com (www.cloudflare.com)... 104.17.210.9, ...
Connecting to www.cloudflare.com (www.cloudflare.com)|104.17.210.9|:443... connected.
HTTP request sent, awaiting response... 522
2020-04-15 17:04:02 ERROR 522: (no description).

You can see that mod_cloudflare.c has been deprecated here:
https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs-Logging-visitor-IP-addresses-with-mod-cloudflare-
and here:
https://github.com/cloudflare/mod_cloudflare

Looks like we need to switch over to mod_remoteip.

I would love some direction on how we might go about doing that.

[heathdutton]

Hmm, thanks for the report, I did not know about this deprecation. Been using mod_cloudflare for so many years now.

Here's the only place that needs changing: https://github.com/TheDMSGroup/mautic-eb/blob/dev/.ebextensions/20_cloudflare.config

Would love a PR on this if you have time to contribute!

[deggertsen]

Yeah, I'll see what I can do. Unfortunately I don't fully understand how this works so it might be awhile before I can figure it out.

If you could give me any direction on how mod_cloudflare is being used that might help give me a jump start.

[deggertsen]

It looks like CloudFlare put the file back up at https://www.cloudflare.com/static/misc/mod_cloudflare/mod_cloudflare.c
But we probably should work towards moving to mod_remoteip anyways.

It looks like this is what needs to be done:

1. Enable mod_remoteip (a2enmod remoteip)
2. Add "RemoteIPHeader CF-Connecting-IP" to the Apache config inside the VirtualHost
3. Update combined LogFormat entry in apache.conf, replacing %h with %a
4. Define trusted proxy addresses as show here

I know how to do all of that on a standard server, but in the EB config files I have no idea...