Start here

Cloudflare in front of Zipper

Optional rented anycast for a website: orange-cloud the web hostname, Zipper stays the origin. Grey-cloud The Cellar. Zipper is not anycast.

What this is

Cloudflare’s anycast IPs can sit in front of a customer website. The visitor lands on a Cloudflare PoP. That PoP opens a new TLS session to 191.215.40.237. Zipper’s Global Server nodes stay unicast origin — this page never claims Zipper is anycast.

Do this for a website

Use Cloudflare nameservers for that customer zone. Zipper’s Herald still does not speak UDP 53.

▸A/AAAA for www → 191.215.40.237, proxied (orange cloud).
▸SSL/TLS: Full (strict). Zipper already presents a publicly trusted certificate.
▸Cache Level: Bypass (or Cache Rules that skip /api, /rest, logins). The Crown stays the cache on Zipper.
▸Do not orange-cloud MX.

Origin A record (registrar stays with Cloudflare DNS)

{ "type": "A", "name": "www", "content": "191.215.40.237", "proxied": true }

Never do this for The Cellar

DATABASE_URL is PGWire on db.tinyzipper.com:5432 and pool.tinyzipper.com:6543. Orange cloud is HTTP 80/443. Spectrum would put another vendor on the hatch — Zipper will not treat that as production.

REST on *.cellar.tinyzipper.com sends Cache-Control / CDN-Cache-Control: no-store so a mistaken proxy cannot cache rows. Grey-cloud those names anyway.

▸db — DNS-only (grey) A → 191.215.40.237
▸pool — DNS-only
▸cellar and *.cellar — DNS-only
▸Do not enable Spectrum on 5432 or 6543

Visitor IP

Moat, Scepter, and nginx rate-limit zones key by the visitor, not the Cloudflare PoP.

When the TCP peer is a published Cloudflare HTTP proxy range, Zipper reads CF-Connecting-IP. A spoofed CF-Connecting-IP on a direct connection is ignored. Direct visitors still see their own address as X-Real-IP.

Absorb on www, cellar stays on Zipper

A marketing site needs packet absorb. The app’s DATABASE_URL must stay sealed.

Orange-cloud www only. Full (strict). Cache Bypass.
Leave db, pool, and *.cellar grey, pointing at 191.215.40.237.
Paste DATABASE_URL as postgresql://…@db.tinyzipper.com:5432 with sslmode=require.

tinyzipper.com itself

The control plane is the product you are selling as a Cloudflare alternative.

Keep the apex unicast. Do not orange-cloud tinyzipper.com, db, pool, or cellar.

Cellar wire (never through orange cloud)

psql "postgresql://service:zc_YOUR_SEAL@db.tinyzipper.com:5432/app?sslmode=require"

Confirm REST is uncacheable

curl -sS -D- "https://tinyzipper.com/api/v1/cellar/demo" -H "content-type: application/json" -d '{"sql":"SELECT 1"}' | head

Next: Getting started · All docs · Create a free account