cmc/cleberg.net

 1#+date:        [2022-06-01 Wed 00:00:00]
 2#+title:       Ditching Cloudflare
 3#+description: Why I moved my DNS away from Cloudflare, and how I did it.
 4#+slug:        ditching-cloudflare
 5#+filetags:    :privacy:security:
 6
 7* Registrar
 8
 9After spending a year or so using Cloudflare for DNS (Domain Name System) only -
10no proxying or applications - I spent the last few months using Cloudflare
11Tunnels and Cloudflare Access to protect my self-hosted websites and
12applications via their proxy traffic model.
13
14However, I have never liked using Cloudflare due to their increasingly large
15share of control over web traffic, as well as their business model of being a
16MITM (man-in-the-middle) for all of your traffic.
17
18So, as of today, I have switched over to [[https://njal.la][Njalla]] as my registrar and DNS manager.
19I was able to easily transfer my domains over rapidly, with only one domain
20taking more than 15-30 minutes to propagate.
21
22+I do still have two domains sitting at Cloudflare for the moment while I decide
23if they're worth the higher rates (one domain is 30€ and the other is 45€).+
24
25#+begin_quote
26*Update (2022.06.03)*: I ended up transferring my final two domains over to
27Njalla, clearing my Cloudflare account of personal data, and deleting the
28Cloudflare account entirely. /I actually feel relieved to have moved on to a
29provider I trust./
30#+end_quote
31
32* DNS
33
34As noted above, I'm using Njalla exclusively for DNS configurations on my
35domains.
36
37However, the transfer process was not ideal. As soon as the domains transferred
38over, I switched the nameservers from Cloudflare to Njalla and lost most of the
39associated DNS records. So, the majority of the time spent during the migration
40was simply re-typing all the DNS records back in one-by-one.
41
42This would be much simpler if I were able to edit the plain-text format of the
43DNS configuration. I was able to do that at a past registrar (perhaps it was
44[[https://gandi.net/][Gandi.net]]?) and it made life a lot easier.
45
46** Dynamic DNS Updates
47
48I have built an easy Python script to run (or set-up in =cron= to run
49automatically) that will check my server's IPv4 (Internet Protocol version 4)and
50IPv6 (Internet Protocol version 6), compare it to Njalla, and update the DNS
51records if they don't match. You can see the full script and process in my other
52post: [[https://cleberg.net/blog/njalla-dns-api.html][Automating Dynamic DNS Record Updates via Njalla API]].
53
54I haven't used this other method, but I do know that you can create =Dynamic=
55DNS records with Njalla that [[https://njal.la/docs/ddns/][work for updating dynamic subdomains]].
56
57** Njalla's DNS Tool
58
59One neat upside to Njalla is that they have a [[https://check.njal.la/dns/][DNS lookup tool]] that provides a
60lot of great information for those of you (AKA: me) who hate using the =dig=
61command.
62
63This was very useful for monitoring a couple of my transferred domains to see
64when the changes in nameservers, records, and DNSSEC (Domain Name System
65Security Extensions) went into effect.
66
67* Tunnel
68
69Cloudflare Tunnel is a service that acts as a reverse-proxy (hosted on
70Cloudflare's servers) and allowed me to mask the private internet protocol (IP)
71address of the server hosting my various websites and apps.
72
73However, as I was moving away from Cloudflare, I was not able to find a suitable
74replacement that was both inexpensive and simple. So, I simply went back to
75hosting [[/blog/nginx-reverse-proxy.html][my own reverse proxy with Nginx]]. With the recent additions of Unifi
76hardware in my server/network rack, I am much more protected against spam and
77malicious attacks at the network edge than I was before I switched to
78Cloudflare.
79
80* Access
81
82Cloudflare Access, another app I used in combination with Cloudflare Tunnel,
83provided an authentication screen that required you to enter valid credentials
84before Cloudflare would forward you to the actual website or app (if the
85website/app has their own authentication, you'd then have to authenticate a
86second time).
87
88I did not replace this service with anything since I only host a handful of
89non-sensitive apps that don't require duplicate authentication.