# How to use Cloudflare with Sliplane

Source: https://docs.sliplane.io/guides/cloudflare

This guide explains how to connect your domain from Cloudflare to a service running on Sliplane.

## Prerequisites

* You must already have a domain added to [Cloudflare](https://www.cloudflare.com/)
* You must have a Sliplane service running

***

## Step 1: Add Your Domain in Sliplane

1. Go to your **service dashboard** in Sliplane.

2. Click the **Domains** tab.
   ![Custom domain settings in Sliplane](/_next/static/media/domain.a12dbdc7.webp)

3. Click **Add Domain**.

4. Enter your full domain (e.g. `example.com` or `app.example.com`) and click **Add**.

5. Sliplane will show you the required DNS record:
   * **Prefer CNAME**: Use CNAME if possible, because it automatically tracks Sliplane IP changes.

![Cloudflare DNS record configuration](/_next/static/media/dns.431cc096.webp)

***

## Step 2: Add DNS Record in Cloudflare

1. Log in to [Cloudflare Dashboard](https://dash.cloudflare.com/).
2. Select your domain.
3. Go to the **DNS** tab.
4. Click **Add Record**:
   * **Type**: CNAME
   * **Name**: `@` for root or your subdomain (e.g. `app`)
   * **Target**: Use the CNAME value from Sliplane
5. Set **Proxy status** to **DNS only** (not proxied).

***

## Step 3: Wait for Domain Verification

* Sliplane will verify the domain within \~15 minutes.
* Once verified, you can **enable the Cloudflare proxy** by toggling the orange cloud back on.

***

## Step 4: Enable Full Strict SSL

1. In Cloudflare, go to your domain.
2. Click **SSL/TLS** in the left menu.
3. Set the **SSL mode** to **Full (Strict)**.

![Cloudflare SSL mode set to Full (strict)](/_next/static/media/full-strict.74dc4128.webp)

***

## Optional: Geo-blocking Exception

If you're using geo-blocking or other firewall features:

Allow requests whose **URI Path starts with** `/.well-known/acme-challenge/` through any rule that would block certificate validation.

For a Cloudflare custom rule, the path condition is:

```text
starts_with(http.request.uri.path, "/.well-known/acme-challenge/")
```

Apply this exception only to the service’s hostname and the rule blocking certificate validation.