Start here
Set up Cloudflare for Citadel
Point proxied (orange cloud) Cloudflare A records at the Citadel ingress IP, set SSL/TLS to Full, and fix domains that stay awaiting DNS.
Configure DNS and SSL
- Open your domain in Citadel and copy its ingress IP from the A record chip.
- In Cloudflare DNS, set the apex (
@) and every hostname you want protected to that IP. - Turn on Proxied (orange cloud) for each protected record.
- In Cloudflare SSL/TLS Overview, select Full or Full (strict) if the origin certificate is trusted.
- Return to Citadel. It checks awaiting domains about every minute; Check connection refreshes immediately.
Troubleshoot activation
A grey-cloud record, the wrong ingress IP, or Flexible SSL can leave a domain awaiting DNS or cause browser errors. DNS-only records skip Citadel entirely. Mail, TXT, and other non-web records remain in Cloudflare.