---
title: Cloudflare With Blossom
url: "/docs/cdn/cloudflare/"
canonical_url: https://docs.blossom88.com/docs/cdn/cloudflare/
markdown_url: https://docs.blossom88.com/docs/cdn/cloudflare.md
summary: Put Cloudflare in front of a dynamic App, or connect a static site's domain
categories:
- cdn
- cloudflare
- security
---

# Cloudflare With Blossom

## Static Sites

Blossom already serves [static sites](/docs/build/static/) through
Cloudflare. Add the hostname under the Environment's **Domains**, then create
a **DNS-only CNAME** to `sites.onblsm.page`. Wait for the Domain to show **Live**.

## Dynamic Apps

Add your domain in Blossom, then point a **proxied** Cloudflare DNS record at
the target shown on the Domain page.

| Blossom Domain mode | Cloudflare SSL/TLS mode |
|---|---|
| Automated HTTPS or Wildcard HTTPS | **Full (strict)** after the certificate is active |
| Self-signed SSL | **Full** |
| HTTP Only | **Flexible**, when you specifically need an HTTP origin |

Prefer Automated HTTPS with **Full (strict)**. It encrypts the origin connection
and validates the certificate. A self-signed origin works with Full, which does
not validate its certificate. [Cloudflare's encryption guidance](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/).

For Automated HTTPS, let Blossom issue the certificate before enabling the
Cloudflare proxy. For Wildcard HTTPS, connect a DNS provider so Blossom can
validate the domain through DNS. See [Domains](/docs/domains/configuration/).

### Rails CDN SSL Configuration

When a CDN terminates HTTPS before forwarding a request to Rails, tell Rails
whether the origin connection is HTTP or HTTPS.

- If the Blossom Domain uses **HTTP Only**, set `CDN_TERMINATES_SSL=true`.
- If the CDN uses HTTPS to reach the Blossom origin, leave the variable unset.

Keep `force_ssl` enabled in both cases:

`config/environments/production.rb`

```ruby
# Set this only when the CDN accepts HTTPS and sends HTTP to Blossom.
config.assume_ssl = ENV["CDN_TERMINATES_SSL"] == "true"
config.force_ssl = true
```

`assume_ssl` makes Rails treat the forwarded request as HTTPS, preventing a
redirect loop while preserving secure URL and cookie behavior. Configure the
CDN to redirect public HTTP requests to HTTPS.

See the Rails configuration reference for
[`config.assume_ssl`](https://guides.rubyonrails.org/configuring.html#config-assume-ssl)
and [`config.force_ssl`](https://guides.rubyonrails.org/configuring.html#config-force-ssl).


## What You Get

Your App on your domain, with Cloudflare handling visitor traffic and Blossom
keeping routing and origin certificates current.