Cloudflare

And not have to mess with apis/terminals/coding/running a server etc. Just want a drag and drop for all of my domains with folders for the URL paths.

So it's not free?
The storage is but views aren't?

You're also not charged for any cache hits for what it's worth, if you set it up properly on a custom domain with cache via a cache rule, only uncached requests

10GB storage is free, 10mil reads per month also are free

The site which the assets appear on isn't proxied.

Just need to configure it correctly. WAF rules and Caching.

If I set it up can you guys help me with the WAF and Caching rules so it's configured in a way that will keep it free? I honestly don't use hosting for much, but since I'm using Cloudflare for everything else I might as well consolidate everything.

Sure, a cache rule to do that is really simple though:
https://cdn.discordapp.com/attachments/1107010297643933746/1107011789411065947/image.png

WAF side, just enabling the defaults should be fine.
You could perhaps set up a rate limiting rule on the subdomain (same `hostname` `equals` match), with some rate limit to try to ward off silly attacks, not sure how much that would be worth doing though.

For what it's worth, the more requests you get, the more your assets are in cache, and you don't pay for cached requests, so just by the way the system works you have some defense there

Thank you. What situations could cause a cost for using this service (based on what I previously said)?

When you store over 10 GB of content, or have over 10 million Class B Requests (which include fetching files), or over 1 million Class A OPerations (Listing Files, Putting Files, etc), you can read over all the pricing here: https://developers.cloudflare.com/r2/pricing/

nah https://blog.cloudflare.com/introducing-cache-rules/

Ah okay. Sounds like I won't hit it then. Is there a way to tell it to reject all requests if I'm about to hit that limit?

best you can do is set up a notification for when you come close

And then I can easily flick a switch to temporarily shut it off?

You can just disable the custom domain yea

For this could I just say if hostname is not literallymakesomethingup.rydercragie.com then apply the rule?

No other way I can think of to get it to work everywhere.

You want the cache rule to apply to everything on your zone, rydercragie.com?

Or is that a bad idea? Should it only apply to subdomains I use for R2?

Usually it would be undesired, depending on your setup. If you're fine with everything on your zone being effected by that rule though, you can just click "Edit Expression" and replace the expression in there with `true`

I'll use the OR rule and set it to all of the R2 hostnames.

Doesn't sound recommended to do what I said.

That could come in handy for the future. I think I have a rule somewhere else that uses a similar thing. I should change it.


https://cdn.discordapp.com/attachments/1107010297643933746/1107023693642743938/image.png

err I picked bad examples for that I suppose. No, it's just a way of checking a field against a list of values

If you have a bunch of r2 hostnames, you can use that
https://cdn.discordapp.com/attachments/1107010297643933746/1107024324684169226/image.png

https://pub-e13ff2f9b2254734a99cbdd556313789.r2.dev doesn't show a page even though there's an index.html file there. What's the issue?

https://pub-e13ff2f9b2254734a99cbdd556313789.r2.dev/index.html

there's no magical index.html detection/routing/etc

if you want that on your custom domain, you can use a transform rule redirect rule (and using that is transparent to the visitor as well, they wouldn't see the path change)

I was about to get annoyed but I'll let it slide since it's possible.

Would a Transform Rule apply to that r2.dev domain?

Guessing not but that's fine as I'm gonna set it up on my custom domain soon anyway.

Would they all have to be separate rules for all of my subdomains/domains?

Or can I just tell it to map index.html to the root?


https://cdn.discordapp.com/attachments/1107010297643933746/1107029949996601434/Screenshot_2023-05-13_at_20.41.32.jpg

checking for /index.html and rewriting to none


https://cdn.discordapp.com/attachments/1107010297643933746/1107030391145123880/image.png

So I don't end up getting charged if someone decides to reload the page 1,000 times.

You could slap on a simple rate limiting rule with sane limits. The WAF Rulesets themselves aren't going to help you with that too much, they're more targeted at vulnerabilities

here's the thing though: You don't get charged for cache hits

I just want something that says if someone refreshes too many times or requests too much, block them.

The more your asset is requested, the more it's going to be in cache, the less requests you pay for

Otherwise if there wasn't it wouldn't be possible.

A downside? One might be that you're potentially serving stale content, it might have changed or been deleted since then

Otherwise not really, other then if you're serving tens of TB's of content per day, you'll probably get a nice sales email asking you to upgrade

This?
https://cdn.discordapp.com/attachments/1107010297643933746/1107047329896353833/Screenshot_2023-05-13_at_21.50.26.jpg

yea, same old `hostname` `equals` `yourr2subdomain.com`

and you can set the limit to a sane amount of requests, maybe  100 per 5 minutes or so

If you have more then one r2 subdomain, you can use is in, sure

`Equals` checks one value, `Is in` checks against a list

If you have one hostname to check, use equals


https://cdn.discordapp.com/attachments/1107010297643933746/1107047855086116864/Screenshot_2023-05-13_at_21.52.53.jpg

Probably don't need to anyway with this in mind.

But all of the other stuff is enabled so should be good in that regards.

you could either set a global sane rate limit (let's say, 200 requests/5 minutes or something, depends on your site), or put all of your assets under the same prefix in your bucket like /assets/, and then use URI Path starts with /assets/

Should all of the default Cloudflare settings be enough?

All of the bot protection stuff that’s built in.

you mean without putting in a rate limiting rule?

Do you have Bot Fight Mode or anything else enabled?

Only was bothered because of cost. But now that’s out of the question I just want to make sure my assets are protected.

I have every security feature enabled I think. Just disabled the ones that were causing issues (ages ago)

You probably don't have BFM on then, it's def one of the ones that can cause a lot of issues

eitherway, CF does have standard DDoS Protection yea, but it can take a hot bit to kick in.  Some of the protections like Gatebot only samples every 1,000 requests, so you need a few hundred requests per second or so before it can even begin to detect something

Is it something to be worried about? Meh, imo not really..

$100 USD would get you some 277 million object requests for example, and that's not including cached requests

The Cahce Rules still apply on the free plan, right?

Indeed. On free your assets are more likely to be evicted, lower min edge cache ttl, and you have a lower max cache size (iirc 512mb?), but that's nothing specific to cache rules

Can I ignore this? https://static.camp-fox.rydercragie.com does have an SSL provided by Cloudflare.
https://cdn.discordapp.com/attachments/1107010297643933746/1107057470314127441/Screenshot_2023-05-13_at_22.30.29.jpg

If I set it up can you guys help me with

This might be a long shot, but can the 200$ subscription be able to contact cf for a discount on the R2 requests pricing after we see a significant amount of volume on that end, or is Enterprise plan a must for that ? and how much does Enterprise costs generally ? <:thonk:861077190813024266>

Enterprise plans generally start around $2k

I can't unproxy it, is r2 exempt from non-html terms when its proxied through cf?
https://cdn.discordapp.com/attachments/940663374377783388/1107012176327229440/image.png

monthly, and that might be a bit low? No hard figures though, it's all based on the stuff you need/requests/etc. On Enterprise you pay for everything request, bandwidth, etc
I don't know the answer to the rest of your questions though, I would assume you need Enterprise with a custom agreement to get anything like that

yes
https://discord.com/channels/595317990191398933/940663374377783388/1079063747726950400
Also the terms have changed recently, might be worth rereading

I can't  find via CTRL+F in <https://www.cloudflare.com/terms/> anything related to non-html, did they removed the rule for everything or is it mentioned somewhere else

Does this mean if I host 10 GB of files it'll cost me $0.15?
https://cdn.discordapp.com/attachments/940663374377783388/1107015178647769240/Screenshot_2023-05-13_at_19.42.25.jpg

What's the UI look like? Is it just drag, drop, upload, choose folder/file path/URL and that's it?