Icy april/update readme

[ukakkar96]

Merge

[baptx]

Is it normal that there is no "Issues" tab to report bugs on this GItHub repository?

It looks like there is a problem with the directive DenyAllButCloudFlare, it only works when the web server is only listening on either HTTP or HTTPS. If a virtual host is configured both for HTTP and HTTPS, the directive DenyAllButCloudFlare is only applied for HTTPS connections. So if we want to access a website that is not automatically redirecting to HTTPS, someone can bypass Cloudflare to access the web server directly on port 80.
Can you confirm this issue and do you have an idea how to fix it?

For testing purpose, I would like to have a domain name available from both HTTP and HTTPS (without automatic redirect).
The only workaround I found is to use Cloudflare flexible SSL instead of full SSL, so all requests are going to the port 80 instead of 80 and 443 (depending on when HTTP or HTTPS is used), which is less secure since HTTPS is not end-to-end encrypted.

[p0358]

@baptx Well, the module is not supported officially anymore. I had some issues related to this directive too, in particular it was giving error 403 sometimes (not sure if it was directly related to this tho, but refreshing it a couple of times used to help)

[baptx]

@p0358 where did you read that it is not supported anymore? I only read that the Debian packages are not supported anymore and that we have to compile from source.

[p0358]

@baptx
https://support.cloudflare.com/hc/en-us/articles/360029696071-Restoring-original-visitor-IPs-Option-2-Installing-mod-remoteip-with-Apache#12345680

Cloudflare no longer updates and supports mod_cloudflare.

[baptx]

@p0358 is there a way to have the same functionality as DenyAllButCloudflare from mod_cloudflare when using mod_remoteip? I would like to block access to users who try to bypass Cloudflare reverse proxy. It looks like iptables is not a solution since I still want to host some websites without Cloudflare.

Update: someone answered here: http://mail-archives.apache.org/mod_mbox/httpd-users/202004.mbox/%3cCAKQ1sVMcfWgObL0aHCLswFq0Pz4dPKEcbWTUm7SMm+ZSVTLfbg@mail.gmail.com%3e
The equivalent of DenyAllButCloudflare using mod_remoteip and mod_rewrite is:

RewriteEngine on
RewriteCond expr "%{REMOTE_ADDR} == %{CONN_REMOTE_ADDR}"
RewriteRule ^ - [F]