In a previous question and answer, I've laid out recent experience in bringing up Craft on the combination of CloudFlare and Railgun offered as a free feature for VPS hosting at Arcustech.
The Pingdom-tools-verified performance results are very good, especially in the combination of North American and European customers that the present site is going to serve.
It was natural to test also Craft features, and only one was found to need some help to operate in this environment. This is to have the very client-useful Live View operate properly when using the Craft CP under SSL/https as the secure.domain.com DNS allows from the previous article.
What actually happens at present is that the Live View pane comes up unexpectedly blank. A look at HTTP headers on the iframe ajax loading that pane along with console messages shows why. The CP runs on https://secure.domain.com, while the Live View iframe is called at https://www.domain.com, which can never be possible on free CloudFlare, as it does not support https. It will simply be silent, and then in a long interval time out. As well, there is a CORS error in the console, which suggests that an Access-Control-Allow-Origin header needs to be present.
In fact, experiment shows that besides the unavailability of https on the www site, such an CORS header from a template (general _layout inclusion) isn't accepted, either from Craft header() or from embedded http-equiv. Perhaps this is because other CORS headers would have to be introduced within the Craft side to allow it. There may be other reasons, but clearly the situation isn't remediable from outside, at least as far as I can see. If CORS would work, still the https accesson the www CloudFlare-free coupling never will by design.
However, experimentation proves a solution. I temporarily modified the siteUrl array for some languages (in general.php) to point to the secure.domain.com site, instead of www.domain.com.
Now Live View worked perfectly for each of the languages so modified, because the iframe calls went to a url that could answer, and which was on the same path as the CP ajax caller. Success as tested, but the real site itself would no longer work through CloudFlare/Railgun, as it would no longer be sent as www.domain.com.
The evident solution is to have the CP iframe ajax load Live View pages by the exact same full URL base as it uses for its own pages. Now everybody would be happy, and there would be no need to entangle CORS as the Live View iframes would be on the same basis as their Ajax loader.
If there were any question whether this internal solution would work in all possible cases, it could be introduced by a general.php config element, so that it could also be turned off.
I would happily spend the hour to build a plugin to arrange this, but I think we are not allowed access by code framework or by license to modify Craft's internals in this area.
If anyone can see a solution from outside, to save effort at Craft, that would be a great answer.
In lieu, I'm hoping to have analyzed this problem in a way to make it very easy for our friends to provide what it needs - and if they don't with better insight than any of us intuit something the matter with such a solution, or realize that there's a better one.
Many very good surprises have indeed come that way, but not necessary here ;)