- How do I get the real client IP behind Cloudflare in a Laravel app?
- When Cloudflare proxies traffic, the remote address your Laravel app sees belongs to a Cloudflare edge server, not the visitor. This package is described as a simple way to determine the real client IP and country by reading Cloudflare's CF-Connecting-IP and CF-IPCountry headers. Use the resolved values instead of relying on $request->ip(), but only trust those headers if your origin firewall accepts traffic exclusively from Cloudflare IP ranges.
- How do I install and configure sumanion/laravel-cloudflare?
- Installation follows the standard Laravel pattern: run composer require sumanion/laravel-cloudflare, publish the package config file, and provide your Cloudflare API token and account or zone identifiers through environment variables. The package ships a service provider and facade, so you can either call the facade or inject the underlying service into your classes. Keep credentials out of source control and use different tokens per environment.
- Does this package manage Cloudflare DNS records and purge cache, or only resolve client IPs?
- The available documentation is inconsistent on this point, which is worth resolving before you adopt it. The package description frames it as a header-parsing utility for real client IP and country, while the overview describes a Cloudflare API wrapper with services for zones, DNS records, and cache purging. Inspect the repository source and README to confirm which behavior is actually implemented, because the two use cases carry very different risk profiles.
- Which Laravel and PHP versions does laravel-cloudflare support?
- The evaluation material does not list supported Laravel or PHP versions, and no CI matrix or test suite is mentioned. Check the composer.json constraints and the Packagist release list before committing, and confirm compatibility with your Laravel major. Version drift against new Laravel releases is flagged as a real risk for a package with little visible adoption.
- What Cloudflare API token permissions does this package need?
- That depends on which operations you actually use, so scope the token to the minimum required. A token limited to cache purge is comparatively benign, while a token that can create, update, or delete DNS records or change zone settings is a production-impacting credential. Create separate least-privilege tokens for staging and production, and avoid account-wide tokens.
- Is it safe to use this package for destructive DNS operations in production?
- Be cautious: the material does not document dry-run mode, idempotency guarantees, or explicit confirmation for DNS create, update, and delete calls. DNS changes are destructive if misused or if arguments are wrong, so validate inputs yourself and test against a sandbox zone first. A sensible pattern is a thin internal service class wrapping the package, so calls can be reviewed, logged, and later replaced without touching call sites.
- How does it handle Cloudflare API rate limits, retries, and partial failures?
- Rate limiting, retry policy, backoff, and error handling are not described in the available material. Treat these as things you must verify in the source and likely implement yourself with Laravel's HTTP client retry options. Log failures explicitly rather than assuming exceptions propagate, since swallowed errors on a cache purge or DNS call are easy to miss in production.
- Can I get the visitor's country code (CF-IPCountry) in Laravel with this package?
- The package description states that it resolves country alongside the real client IP, which means reading Cloudflare's CF-IPCountry header on proxied requests. Remember that the country is inferred by Cloudflare from the client IP and can be inaccurate for VPN or Tor traffic, and may return a placeholder value when unknown. Always treat it as a hint, not an authorization signal.
- Is laravel-cloudflare actively maintained and production ready?
- There is no visible adoption signal: zero stars, zero dependents, a single maintainer, and no documented security disclosure path. That makes it glue for narrow, well-bounded operations rather than a platform dependency. If you need a hardened long-term option, compare against the official Cloudflare PHP SDK or a small in-house client built on Laravel's HTTP client.
- How do I test a Cloudflare integration without hitting production?
- Point the package at a sandbox Cloudflare zone with a scoped test token, and fake outbound HTTP calls with Http::fake in your test suite so no real requests leave CI. Assert on the endpoints and payloads your code sends rather than on Cloudflare responses. Never run destructive DNS tests against a live zone, and keep production tokens out of your test environment entirely.