Help needed setting up seq behind cloudflare.

[ddjerqq]

I am hosting my seq node on my server, and I have Cloudflare protection enabled for it.

I want the security level to be high, but I want to allow seq traffic through. I have made the following rule (expression¹) to allow seq clients which have the X-Seq-ApiKey header set to skip protection

However, I get the error:
A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond

Seems as if I can't even connect to the server? the request is getting blocked...

To Debug

I send the following trace through cloudflare

curl --request POST \ 
  --url "https://api.cloudflare.com/client/v4/accounts/myaccount/request-tracer/tracer" \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer $CF_AUTH_TOKEN" \
  --data '{
  "url": "https://seq.MYDOMAIN.dev/api/events/raw",
  "method": "POST",
  "headers": {
    "X-Seq-ApiKey": "SOMEKEY",
    "Content-Type": "application/json"
  },
  "context": {
    "bot_score": 1
  },
  "body": {
    "json": {
      "evt": "doesn't matter"
    }
  }
}'

but this trace seems to be getting through. the 403 is from seq, because the key is not valid

As a workaround

I have disabled proxying for now, however, that is not a good approach, I want a good working solution to allow my requests that match the expression¹ to pass through

I know this is a Cloudflare issue, because sending events to the server IP without a domain works. But I am posting this in the seq Github discussions to see if anyone had the same issues as me, and if they could help me solve it. Thanks!

P.S. I also have some trouble with SSL, the certificate seems to not be valid. I am using the origin server certificate from Cloudflare. Do I need to use something different? like an Edge certificate?

Footnotes

1. Expression: (http.request.uri.path eq \"/api/events/raw\" and http.request.method eq \"POST\" and len(http.request.headers[\"x-seq-apikey\"]) > 0 and any(http.request.headers[\"content-type\"][*] in {\"application/json\" \"application/vnd.serilog.clef\"})) ↩ ↩²

[ddjerqq]

The SSL issue was because I was using the Origin certificate, and I needed to use an Edge certificate