Tophhie Social runs on its own PDS (Personal Data Server, in ATproto terms), hosted on a VM in Azure and sitting behind Cloudflare. Cloudflare is doing a lot of the heavy lifting there: TLS, DDoS protection, the WAF rules that keep obvious junk traffic away from the actual server. The assumption I had been making, without ever really checking it, was that Cloudflare was the only way in. That anyone hitting pds.tophhie.cloud had to go through Cloudflare's edge first.
That assumption was wrong. The original server's firewall had ports 80 and 443 open to the entire internet, not just to Cloudflare. Which meant that if you know (or found) the server's actual IP address, you could connect directly and skip Cloudflare entirely. No WAF, no rate limiting, no DDoS protection. Just you and the raw server.
I proved this to myself with a single curl command, forcing my own DNS resolution to point straight at the origin's IP instead of going through Cloudflare. It worked. The PDS answered, cert and all, like nothing was wrong. That's the moment this stopped being theoretical.
Finding out is not blocking
It's worth being honest about how this usually goes: a locked-down firewall on the server itself world have caught these years ago and normally would have been the obvious first move. I went a different route, and I think it's the better one for a public-facing service like this: Cloudflare Authenticated Origin Pulls.
The idea is simple. Instead of the origin trusting any connection that shows up on port 443, it only accepts connections that present a specific certificate that only Cloudflare holds. Cloudflare presents that certificate automatically on every request it proxies through to the origin. Anyone who tries to connect directly, bypassing Cloudflare, gets no certificate to offer, and the connection is refused before it even reaches the application.
I tested this the same way I'd found the problem in the first place: same direct-IP curl trick, after the change went live. This time it failed outright, refused at the TLS handshake, before the server even had chance to respond. That's the proof that mattered to me. Not "I think this works", but watching the exact attack I'd demonstrated get shut down.
A second layer, for the traffic that does get through
Locking the front door doesn't mean every visitor is well-behaved. Cloudflare passes through the real traffic Tophhie Social is meant to serve, including the occasional attempt to brute-force login endpoints or poke around at API paths that don't exist. That's normal for anything public on the internet, and it's not something a firewall rule alone fixes.
So, alongside the origin lockdown, I set up Fail2Ban to watch the server's request logs and automatically block IPs that show a clear pattern of abuse, repeated failed logins, repeated hits on nonexistent endpoints, that kind of thing. When it detects that pattern, it doesn't just block the IP locally. It reaches out to Cloudflare's API and adds the address to an account-wide block list, which covers every domain under the Tophhie Cloud umbrella, not just the one that got hit. One back actor probing Tophhie Social gets blocked everywhere, automatically, without me having to do anything.
Getting that integration working took more back-and-forth than I expected. The first version of the automated ban looked like it was working, right up until I checked whether the block had actually landed on Cloudflare's side, and it hadn't. A second attempt fixed that, then broke the automatic unban when a block expires. Small, boring bugs, the kind you only catch by actually testing both directions of the thing you built rather than trusting that it probably works. It does now, verified end to end: a ban that shows up in Cloudflare's dashboard within seconds, and an unban that cleans itself up just as reliably once the ban period is over.
Where this leaves things
Tophhie Social's origin no longer trusts anything that isn't provably Cloudflare. On top of that, genuine abuse that does not make it through the WAF gets caught and blocked automatically, across the whole account, without waiting on me to notice and act manually.
None of this is exotic. Authenticated Origin Pulls and Fail2Ban are both established tools, and there's nothing here I'd call clever. What made the difference was actually checking the assumption I'd been running on for a long time, that Cloudflare was the only path in, instead of just trusting it. It wasn't. Now it is.
No comments yet