Jaeger all-in-one behind Cloudflare TLS

[mikeumus]

Has anyone ever put Cloudflare in front of all-in-one?

I'm having quite a time with it.
I finally got it working if I turn off SSL/TLS completely off. 🤦🏻‍♂️
I'd like to have it working with TLS turned on of course.

Here's my jaeger-config.yaml

collector:
  grpc-server:
    host-port: ":2082"
  grpc:
    tls:
      cert: ${CERT_PATH}
      key: ${CERT_KEY}
      enabled: "true"
  http-server: 
    host-port: ":2053"
query:
  http-server:
    host-port: ":2096"
reporter: 
  grpc: 
    tls:
      enabled: "true"

I'm using a Cloudflare Client Certificate that I put on the Jaeger server as the CERT_PATH and CERT_KEY

Here's my `cf-terraforming` export:

resource "cloudflare_filter" {
  description = ""
  expression = "(http.request.uri.path eq \"/api/traces\")"
}

resource "cloudflare_filter" {
  description = ""
  expression = "(http.host in {\"trace.filevacuum.com\"} and not cf.tls_client_auth.cert_verified)"
}

resource "cloudflare_firewall_rule" {
  description = "Jaeger Tracing API Endpoint"
  action = "allow"
}


resource "cloudflare_page_rule" {
    zone = "filevacuum.com"

    target = "www.filevacuum.com/"

    priority = 1
    actions = {
        forwarding_url {
            status_code = 301
            url = "https://filevacuum.com"
        }
    
    }
}

resource "cloudflare_record" {
    domain = "filevacuum.com"

    name = "trace.filevacuum.com"
    type = "A"
    ttl = "1"
    proxied = "true"

    value = "45.77.219.134"
}


resource "cloudflare_record" {
    domain = "filevacuum.com"

    name = "www.filevacuum.com"
    type = "CNAME"
    ttl = "1"
    proxied = "true"


    value = "filevacuum.com"
}


resource "cloudflare_zone" "filevacuum_com" {
    zone = "filevacuum.com"

    plan = "free"
}


resource "cloudflare_zone_settings_override" {
	name = "filevacuum.com"
	settings {
		0rtt = "on"
		advanced_ddos = "on"
		always_online = "on"
		always_use_https = "off"
		automatic_https_rewrites = "on"
		brotli = "off"
		browser_cache_ttl = 14400
		browser_check = "off"
		cache_level = "aggressive"
		challenge_ttl = 3.1536e+07
		ciphers = []
		cname_flattening = "flatten_at_root"
		development_mode = "off"
		edge_cache_ttl = 7200
		email_obfuscation = "on"
		hotlink_protection = "on"
		http2 = "on"
		http3 = "on"
		ip_geolocation = "on"
		ipv6 = "on"
		max_upload = 100
		min_tls_version = "1.0"
		minify {
			css = "off"
			html = "off"
			js = "off"
		}
		
		mirage = "off"
		mobile_redirect {
			mobile_subdomain = ""
			status = "off"
			strip_uri = false
		}
		
		opportunistic_encryption = "off"
		opportunistic_onion = "on"
		orange_to_orange = "off"
		origin_error_page_pass_thru = "off"
		polish = "off"
		prefetch_preload = "off"
		privacy_pass = "off"
		pseudo_ipv4 = "off"
		response_buffering = "off"
		rocket_loader = "off"
		security_header {
			
			enabled = false
			include_subdomains = false
			max_age = 0
			nosniff = false
			preload = false
				
		}
		
		security_level = "essentially_off"
		server_side_exclude = "on"
		sort_query_string_for_cache = "off"
		ssl = "off"
		tls_1_2_only = "off"
		tls_1_3 = "zrt"
		tls_client_auth = "on"
		true_client_ip_header = "off"
		visitor_ip = "on"
		waf = "off"
		webp = "off"
		websockets = "on"
	}
}

[jpkrohling]

Any error messages?

[mikeumus]

@jpkrohling
Just found the --query.http.tls.enabled flag which I'm pretty sure is the right one for the UI server and added these flags to my jaeger/all-in-one run command:

    --query.http.tls.enabled=true \
    --query.http.tls.cert=${envVar:CERT_PATH} \
    --query.http.tls.key=${envVar:KEY_PATH}

again I'm using a Cloudflare Client Certificate in CERT_PATH and CERT_KEY so many the certificate isn't right for this.

I tried it without my own CERT_PATH and CERT_KEY but that timed out too.

[Ashmita152]

Hi @mikeumus

From your config, it seems like the query is listening on 2052

query:
  http-server:
    host-port: ":2052"

But in the screenshot, I see you're visiting 2096 port. Am I missing something ?

[mikeumus]

@Ashmita152, good eye, I just forgot to update the first post.

[jpkrohling]

Are you able to hit your collector bypassing Cloudflare? If a regular browser can make a connection, Cloudflare should also be able to...