Start here
Set up Cloudflare for Citadel
Point proxied (orange cloud) Cloudflare A records at the Citadel ingress IP, set SSL/TLS to Full, and fix domains that stay awaiting DNS.
Configure DNS and SSL
- Open your domain in Citadel and copy its ingress IP from the A record chip.
- In Cloudflare DNS, set the apex (
@) and every hostname you want protected to that IP. - Turn on Proxied (orange cloud) for each protected record.
- In Cloudflare SSL/TLS Overview, select Full or Full (strict) if the origin certificate is trusted.
- Return to Citadel. It checks awaiting domains about every minute; Check connection refreshes immediately.
Troubleshoot activation
A grey-cloud record, the wrong ingress IP, or Flexible SSL can leave a domain awaiting DNS or cause browser errors. DNS-only records skip Citadel entirely. Mail, TXT, and other non-web records remain in Cloudflare.
Cloudflare DDoS protection and Citadel
With proxied records, traffic passes through Cloudflare first, so Cloudflare's own DDoS protection still applies. Citadel then inspects the HTTP requests that reach it, with challenge levels, rate limits and per-domain logs, before it forwards clean traffic to your origin.