Update readme on how to setup cloudflare to work with drupal

[aweingarten]

Requirements

• Getting cloudflare setup the first time is a little tricky. Update the update.txt instructions with details.
• Instructions for setting up SSL.
• Setting up page rule: Out of the box it only caches static resources you need to configure a page ruleset to cache everything in order for it to cache page

[aweingarten]

cc: @CashWilliams any other ideas here?

[wimleers]

These have been confirmed by CloudFlare to be the optimal settings.

---

Wim:

I'm explicitly opting out of SSL, "apps", and all of the performance improvements that could potentially break things.

I have "cache everything" enabled, because that is AFAICT what is necessary to cache dynamic content also. I choose the most aggressive (longest duration) edge caching. I do let Drupal 8's headers determine how long browsers should do caching (this helps make CloudFlare be a transparent acceleration layer). I let my session cookie trigger bypassing the caching, so that authenticated users always hit origin (again, CloudFlare as a transparent acceleration layer; note that these session cookies have unique names per site). And that's it AFAICT? :) Please advise!

CloudFlare:

Looks good!

[wimleers]

Updated recommended configuration.

Two changes:

1. The addition of the asterisk in the domain name, the rule above only matched the frontpage.
2. CloudFlare has a bug when you set the edge TTL to 1 week, which strips all Set-Cookie headers in responses to POST requests. Which means you can't log in at all. Setting it to "Respect existing headers" makes it work.

[CashWilliams]

@wimleers The session cookie stays the same always? I'd have guessed the setting should be something like [S]SESS* (if it were to support regex type wild cards)

[Vacilando]

Unfortunately, the option "Bypass cache cookie" is available only for Enterprise plans (just checked with CloudFlare support).
Is there a way to use HTML caching ("Cache Everything") with CloudFlare without that option?

[ohthehugemanatee]

I don't think we should need an explicit cookie rule. According to cloudflare, if there's a cookie in the response, they don't cache.
https://support.cloudflare.com/hc/en-us/articles/202775670-How-Do-I-Tell-Cloudflare-What-to-Cache-

[ohthehugemanatee]

I take it back - I see the problem now. If an anon has visited a given path before the admin does, the admin will get served by cloudflare.