Domain via your own server (proxy agent)

What it is

By default, a domain is served by our shared edge via Cloudflare. The “Customer server” mode lets you point a domain to your own server: a lightweight proxy agent is installed on it, and traffic then goes on to our tracking and storage infrastructure. From the outside, the domain looks as if it is hosted entirely on your side.

Why you need it

• No shared fingerprint. The domain lives in your Cloudflare account and points to your server — DNS/WHOIS show no link to the shared platform.
• Origin is hidden. Real infrastructure addresses are not exposed.
• Abuse isolation. Blocks and complaints stay on your server/IP, not on the shared zone.
• Visitor geo is preserved. Tracking sees the visitor's real country and city, not the server's.

The “Servers” section is available to the team owner, team lead and tech specialist. The domain must be in your own Cloudflare account: the “Customer server” mode is not available for the platform's system Cloudflare.

What you need

1. A server — a clean virtual machine (Ubuntu) with SSH access as root with a password. It is best to dedicate the server to the agent only.
2. Your own Cloudflare account added to the platform (the “DNS providers” section).
3. The domain itself.

Step 1. Add a server

1. Open Technical → Servers.
2. Click Add server and fill in: name, IP address, SSH port (usually 22), SSH user (usually root) and root password.
3. Save. The platform automatically installs Docker and the proxy agent, configures the firewall and connects to the server with its own secure key.

Important: the root password is used once for the initial setup and is not stored anywhere.

Step 2. Wait for the “Ready” status

The status changes automatically: Pending → Provisioning → Ready, usually within a couple of minutes. If the server goes to Error, open it and check the provisioning log — it shows at which step the problem occurred (most often the server is unreachable via SSH or the password is wrong). Fix the cause and choose Re-provision in the server menu (the root password will be required).

Step 3. Point the domain to the server

You can select the server in three places — in each of them, right after selecting the Cloudflare account:

• Domain registration (wizard, Cloudflare step) — the “Where to route domains” field.
• Domain transfer (parking) — the “Where to route the domain” field.
• Domain editing — the “Where the domain points” section: select “Customer server”, pick a server from the list and click Apply.

The platform itself creates an A record pointing to the server IP in your Cloudflare zone (in proxy mode) and switches the zone SSL to Flexible mode — the agent accepts connections from Cloudflare over HTTP. Nothing needs to be changed manually.

To return the domain to the shared edge: in the editor, select “Our edge” and click “Apply”.

Step 4. Delegate NS

If the domain is parked without a registrar, after saving the window shows the Cloudflare NS servers with a copy button. Set them at your registrar. Once the delegation is picked up, the domain automatically switches to the Active status.

When parking or registering through a connected registrar, NS are set automatically.

Server actions

In the server menu (the “⋮” button in the row):

• Update agent — updates the agent image and settings and re-applies the firewall. No password needed; the agent restarts within a few seconds.
• Rotate key — issues a new access key to the agent; the old one stops working immediately. Use it if the key may have fallen into the wrong hands (for example, it was exposed in a chat or in logs). No password needed.
• Re-provision — a full redeployment from scratch. The root password is required.

Firewall on the server

The platform enables UFW: ports 80 and 443 are open only to Cloudflare subnets, so the site cannot be accessed by the server IP bypassing your Cloudflare. SSH and other ports are not restricted — you can still log in to the server as before.

“Server” column in the domains table

• Our edge — the domain is served by the platform's shared edge (default).
• Server name — the domain is pointed to your server; the IP is shown on hover.

Manual DNS update

Template-based DNS sync (single and bulk) brings the domain records in line with the current selection: for a domain on a customer server — an A record pointing to the server IP; for a domain on our edge — the standard record.

FAQ

Cloudflare error 521. Cloudflare could not reach the server. Check that the server is in the “Ready” status, the domain is in “Customer server” mode, and the zone SSL in Cloudflare is Flexible. If you changed SSL manually, click “Apply” in the domain again.

The server is “Ready”, but the domain does not open. Check that the domain's NS are delegated to the correct Cloudflare account and the A record is proxied (orange cloud).

Can I use the system Cloudflare? No: the “Customer server” mode works only with your own Cloudflare account.