I'm going to answer this one, to share information on how I just did it. One issue will remain, but that will be raised in a separate question.
The first thing is to understand the URL layout which CloudFlare/Railgun will require. You or your hoster will create A records in DNS for all but one of these, each of them pointing to your server IP.
There's an ...
The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No .htaccess or Patrol plugin required.
If someone knows more about why this worked and the previous approach didn't I would love to hear your thoughts. Thanks @...
I'm not completely sure, but would setting site_url to always be whatever the server host is work in this case? In my general.php I use the following before the config array:
$protocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https://' : 'http://';
$base_url = $protocol . $_SERVER['HTTP_HOST'] . '/';
Cloudflare's CDN isn't a true CDN like Amazon, Rackspace, or Google.
With Cloudflare you host your assets on the server and Cloudflare then automatically keeps a cached copy of that.
In other words, you don't upload to CloudFlare, CloudFlare downloads from you.
So on Craft, simply use the "Local folder" source type.
The CSRF token is likely expiring. Since pages are cached with Blitz, you must use some strategy to ensure that a fresh CSRF token is loaded into the page on each page that is statically served. The simplest way to do this is to use the Dynamic Content feature in Blitz, specifically craft.blitz.csrfInput().
Craft's default setting is 'resourceBaseUrl' => '@web/cpresources'. If your site or Docker Container runs http, Craft seems to (correctly) determine the http setup. This is why it ignores your siteUrl / ROOT_SITE_URL.
To fix this, either overwrite @web or manually set 'resourceBaseUrl'.
Explictly set 'resourceBaseUrl' => getenv('...
It's probable that your Site URL in your website's config is using http rather than https. Setting it to https should force the control panel assets to load appropriately.
You can change this in Craft's Settings > System > General screen.
If you've overriden this in your website's config setting you'll instead need to update the siteUrl setting in ...
I've checked Josh's answer above, because it does the trick. I'm going to put here another approach, one that came literally in an epiphany late last night, just floated up. I enjoy it when that happens.
What we do here is just make use of multi-environmental config, in general,.php. Because the SSL admin is on a subdomain to fit with free CloudFlare, this ...
Taylor, I think your best bet would be to email support at Arcustech directly about this.
They're very able to help; just put clear questions to them and think you'll be pleased.
As far as I am aware, the arrangement I used would be the same as you would get on a higher end plan -- it's Arcustech's node point that enables the Railgun part in either case.