Cloudflare acts as a reverse proxy when you enable Proxied DNS (the orange cloud). Incoming traffic to your domain first passes through Cloudflare before reaching your server, providing DDoS protection and performance benefits.
The installer asks whether you're using a reverse proxy. If your DNS records are proxied, answer yes, or set it later in INSTALL_DIR/.5stack-env.config:
REVERSE_PROXY=trueRe-run ./update.sh after changing it. See Reverse Proxy for details.
The proxy blocks the HTTP challenge Let's Encrypt uses to issue certificates. Add a redirect rule exception for /.well-known/acme-challenge/*. See DNS & SSL.
ws.yourdomain.com must be able to upgrade connections. Cloudflare enables WebSockets by default (Network → WebSockets); if live match data or chat never connects, confirm it is still on.
Cloudflare's proxy only forwards a fixed set of ports. If you changed the default 80/443 ports. The proxy will not reach your panel. Use a Cloudflare Tunnel or DNS-only records instead.