One server behind the Cloudflare proxy
Cloudflare’s proxy is not a load balancer, but Cloudflare Load Balancing is a small step away from it: a pool, your server as the origin, a health monitor. With TLS already terminated at Cloudflare there is nothing to move on the server, which is why this is one of the shortest cases.
- Prerequisite work
- Cloudflare Load Balancing, pool and origin, firewall to CF IPs
- Time to set up
- 30–45 min
- Adapter
- Snapshot or webhook
- Fit
- 8/10
Prerequisites, time and fit are the ADR-0028 row for this case. Hetscale's own setup is about 15 minutes in every case; the rest is work on your side.
Steps
- 01Enable Cloudflare Load Balancing
Create a load balancer for your hostname with one pool and your server as its origin, and a health monitor on your app’s health endpoint. That monitor is the readiness signal Hetscale trusts.
- 02Allow only Cloudflare to reach the origin
Restrict the server firewall to Cloudflare’s IP ranges. Onboarding checks this: a node that any client can reach directly bypasses the balancer.
- 03Create a scoped API token
A Cloudflare token with Load Balancing write permission only. Hetscale adds and removes origins with it and never touches DNS or other zone settings.
- 04Connect read-only
Start the 14-day Observe trial with a read-only Hetzner token; the day-0 report shows what a group would have done with your last 30 days.
- 05Rehearse, then go Live
One Rehearsal creates a node, registers it as an origin, waits for the monitor, drains it through Cloudflare’s native drain and deletes it. Then set minimum 2 and go Live.
FAQ for this case
Do I need a Hetzner load balancer as well?
No. Cloudflare Load Balancing is one of the two traffic providers; origins are the nodes’ public IPs.
What does Cloudflare Load Balancing cost?
It is a Cloudflare add-on billed by Cloudflare; the price and the health-monitor interval depend on your plan. Check both before you start; Hetscale does not resell it.
How is a node removed?
Cloudflare’s own drain: the origin is disabled with a drain duration, connections finish, then the server is shut down and deleted.