This guide is for customers who need their own CDN or reverse proxy in front of their Vanilla community. It is written for network, DNS, and CDN administrators.
Vanilla already operates a CDN at the edge. A customer reverse proxy is optional. Use it only when your organization requires it (for example a corporate CDN standard, existing Akamai or CloudFront property, or a Cloudflare zone you already manage).
If you are not placing your own proxy in front of Vanilla, follow the standard custom-domain CNAME setup from Vanilla instead. You do not need this guide.
What every reverse proxy must do
A reverse proxy in front of Vanilla is supported when the request that reaches Vanilla is the same request the browser made: it must arrive, it must be a valid HTTPS request, and it must carry every header and cookie the browser sent.
Vanilla does not publish an allowlist of headers. Do not filter, rename, or drop headers. The same rule applies to cookies: forward all of them, with no cookie allowlist or stripping.
That includes at least:
- Host - usually the public community hostname (for example community.example.com).CloudFront is the exception:Host must be the Vanilla origin hostname(yourname.vanillacommunities.com). See the CloudFront section.
- User-Agent - the browser or client identity
- Every other request header the browser sent (Cookie, Accept, Accept-Language, Content-Type, Origin, Referer, CSRF and session headers, and anything else)
- Every cookie, with no filtering
Also send X-Forwarded-For with the visitor's IP address. If you omit it, Vanilla's logs and security controls see only your proxy's IPs (Akamai, CloudFront, and similar), not the real client.
Do not replace an existing X-Forwarded-For chain. Append the visitor IP if your platform requires you to set it.
Cloudflare orange-to-orange (O2O) is the exception to the configuration work above. Cloudflare already preserves the original request when your proxied CNAME points at Vanilla. You still follow theDNS steps in the Cloudflare section. You do not configure header, cookie, or X-Forwarded-For forwarding yourself.
Akamai, CloudFront, and any other reverse proxy must meet the rules in this section explicitly.
Summary
Your proxy | What you do | What Vanilla does |
|---|
Cloudflare | CNAME as usual (DNS only). After the community is live, you may orange-cloud (proxy) the record. Cloudflare preserves headers and cookies. | Nothing extra. |
Akamai | Meet the forwarding rules above. Origin-pull to Vanilla using a private CA Vanilla provides. | Issues the private CA material and loads the matching certificate. |
AmazonCloudFront | Meet the forwarding rules above. Origin-pull to a Vanilla hostname that already has a publicly trusted certificate(yourname.vanillacommunities.com). | Configures the community so links and requests use your public hostname. |
Contact your Vanilla account or support team before go-live for Akamai and CloudFront. Cloudflare orange-cloud does not need a Vanilla change once the standard CNAME setup has completed.
Cloudflare
Use this when the customer-facing hostname lives in a Cloudflare zone you control.
This is the special case. After the standard CNAME setup completes, you may enable Cloudflareproxying (orange cloud) on that CNAME. Cloudflare then hands the request to Vanilla's Cloudflare(orange-to-orange) and keeps the original headers and cookies. You do not configure a headerallowlist, cookie forwarding, or X-Forwarded-For.
Visitor -> your Cloudflare zone -> Vanilla's Cloudflare -> the community
Steps
- Create the CNAME Vanilla gives you for your community hostname (for examplecommunity.example.com).
- Leave the record DNS only (grey cloud / not proxied).
- Wait until Vanilla confirms the hostname is active and HTTPS works when you visit thecommunity on your hostname.
- Optional: change the CNAME from DNS only to Proxied (orange cloud).
Do not orange-cloud the record in step 1. Proxying before Vanilla finishes hostname and certificatesetup will block validation.
Notes
- You do not need a custom certificate on Vanilla's side for this path.
- Keep the CNAME target exactly as Vanilla provided. Do not point it at a different origin.
- After you orange-cloud, allow a few minutes for DNS and cache, then confirmhttps://community.example.com still loads.
- Avoid Transform Rules, Header modification, or cookie stripping on this hostname. If you addthem, this path stops being "Cloudflare handles it" and you must preserve the original requestyourself.
Akamai
Use this when Akamai must be the public entry point for the community.
How it works
Vanilla loads a certificate for your community hostname that is signed by Vanilla's private CA. Vanilla gives you that CA certificate. You configure Akamai to trust it when Akamai connects to Vanilla.
That avoids Akamai sitting in the middle of public certificate validation (HTTP and DNS TXT). PublicCA renewals would otherwise fail or become unreliable through Akamai.
Visitor -> Akamai -> Vanilla's Cloudflare -> the community
Steps
- Tell Vanilla you will front the community with Akamai, and confirm the public hostname (forexample community.example.com).
- Optional: complete the normal Vanilla custom-domain CNAME setup for that hostname. You do not have to. Vanilla can create the hostname on our side. If you already set it up the normal way, Vanilla will replace the public certificate on our Cloudflare with the private-CA certificate used forAkamai trust.
- Vanilla provides the private CA certificate (the CA, not a private key) and confirms the originhostname and port to use.
- In Akamai, create or update the property:
- Origin is the Vanilla hostname you were given. - Origin protocol is HTTPS. - Origin certificate validation trusts the Vanilla private CA you were given. - Forward all browser headers as-is, including Host and User-Agent. Do not allowlist a subset. - Forward all cookies. Do not filter them. - SendX-Forwarded-For with the visitor IP (append; do not drop the client address).
- Point your public DNS at Akamai as you would for any other Akamai property.
- Verify https://community.example.com loads, including login, uploads, and a signed-out page.
What to request from Vanilla
- Private CA certificate file
- Origin hostname
- Confirmation that the community hostname is serving the private-CA certificate
Notes
- Do not try to originate from Vanilla with a publicly trusted certificate through Akamai. Akamaiintercepts the validation methods those certificates need.
- You should not need to change Akamai origin trust when Vanilla rotates the site certificate, aslong as the new site certificate is still signed by the same CA.
- If Akamai is configured to require a public CA only, origin TLS to Vanilla will fail. Load the Vanillaprivate CA.
- If login, sessions, CSRF, or bot checks fail, the usual cause is a header or cookie being stripped.Forward everything.
Amazon CloudFront
Use this when CloudFront must be the public entry point for the community.
Why this path is different
CloudFront will not trust a private CA. It requires a certificate from a public CA on the origin.
Vanilla cannot issue a public certificate for your customer-facing hostname while CloudFront isalready proxying that hostname. CloudFront intercepts the HTTP and DNS TXT checks certificateauthorities use.
Instead, CloudFront origins against a Vanilla hostname that already has a normal public certificate:
https://yourname.vanillacommunities.com
CloudFront origin-pulls to that Vanilla hostname. Visitors still typehttps://community.example.com. As far as Vanilla's Cloudflare is concerned, the request is foryourname.vanillacommunities.com. Vanilla then maps the community to your public hostname solinks, redirects, and cookies use that name.
Visitor -> CloudFront -> yourname.vanillacommunities.com (Vanilla) -> the community
TLS and HTTP Host toward Vanilla must both be the origin hostname(yourname.vanillacommunities.com). Vanilla's Cloudflare routes on Host. If CloudFront sends
Host: community.example.com, Cloudflare does not know what to do with the request.
Use an origin request policy that forwards all viewer headers exceptHost (AWS managedAllViewerExceptHostHeader). CloudFront then sets Host to the origin domain. Do not forward oroverride Host to the public hostname.
Steps
- Tell Vanilla you will front the community with CloudFront. Provide:
- Public hostname (for example community.example.com) - Preferred vanillacommunities.comhostname if you already have one
- Wait for Vanilla to confirm the origin hostname (for example acme.vanillacommunities.com)and that the community is bound to your public hostname.
- Create a CloudFront distribution:
- Origin domain: the vanillacommunities.com hostname Vanilla gave you. - Origin protocol: HTTPSonly. - Alternate domain name (CNAME): your public hostname (community.example.com). - Viewercertificate: a publicly trusted certificate you control for the public hostname (ACM is typical). - Originrequest policy: forward all viewer headers and cookies except Host. Use AWS managed AllViewerExceptHostHeader. CloudFront must send Host: yourname.vanillacommunities.com. - Forward all cookies. Do not filter them. - Send X-Forwarded-For with the visitor IP. Do not stripCloudFront's X-Forwarded-For.
If you use a custom policy, include that header.
- Point DNS for the public hostname at the CloudFront distribution.
- Verify https://community.example.com loads and that in-app links stay on that hostname, noton vanillacommunities.com.
CloudFront settings that usually matter
Setting | Required |
|---|
Origin domain | yourname.vanillacommunities.com (from Vanilla) |
Origin protocol | HTTPS only |
Origin request headers | All viewer headers except Host (AllViewerExceptHostHeader) |
Origin Host | Origin domain (yourname.vanillacommunities.com), not the publichostname |
Cookies | All cookies, no filtering |
X-Forwarded-For | Visitor IP present (do not strip) |
Alternate domainnames | Your public community hostname |
Viewer protocol | Redirect HTTP to HTTPS |
Notes
- Do not point CloudFront at your public community hostname as the origin. Origin must be the Vanilla vanillacommunities.com hostname you were given.
- TLS for visitors terminates on CloudFront, using your ACM (or equivalent) certificate. TLS fromCloudFront to Vanilla uses the public certificate on yourname.vanillacommunities.com. SNI and Host toward Vanilla are that origin name. Vanilla's Cloudflare treats the request as a visit tothat hostname.
- If login, sessions, CSRF, or bot checks fail, the usual cause is a header or cookie being stripped. Forward everything except viewer Host.
Which option should you use?
- You already use Cloudflare for the hostname -> Cloudflare path. Simplest. Cloudflare preserves the request.
- You already use Akamai as the corporate CDN -> Akamai path. Requires Vanilla to issueprivate CA trust material, and you must forward all headers and cookies.
- You already use CloudFront as the corporate CDN -> CloudFront path. Requires Vanilla tomap the public hostname onto the vanillacommunities.com origin, and you must forward allheaders and cookies.
Other reverse proxies follow the same rule as Akamai and CloudFront: the original browser requestmust reach Vanilla intact, with X-Forwarded-For set. Open a ticket with Vanilla before building anunlisted proxy. Certificate setup will follow either the Akamai model (custom CA) or the CloudFrontmodel (public origin hostname).
What to send Vanilla
When you open the request, include:
- Public community hostname (the URL users will see)
- Which proxy you will use: Cloudflare, Akamai, or CloudFront
- Target go-live date
- Technical contact
- For Akamai: confirmation you can load a custom origin CA, and that you can forward all headersand cookies plus X-Forwarded-For
- For CloudFront: AWS account region for ACM, whether you already have avanillacommunities.com hostname, and confirmation you will use AllViewerExceptHostHeader (all cookies and headers except viewer Host) plus X-Forwarded-For
Quick checklist
All reverse proxies except Cloudflare O2O
- All browser headers forwarded as-is, including User-Agent (no header allowlist). Host:public hostname for Akamai; origin hostname for CloudFront.
- All cookies forwarded (no cookie filtering)
- X-Forwarded-For contains the visitor IP
- HTTPS to Vanilla succeeds with a valid request
Cloudflare
- CNAME created as DNS only
- Vanilla hostname setup completed and HTTPS works
- Proxy (orange cloud) enabled only after that
- No header, cookie, or transform rules stripping the original request
- Community still loads on the public hostname
Akamai
- Vanilla has issued the private CA and loaded (or replaced) the site certificate
- Akamai origin is HTTPS to Vanilla
- Akamai trusts the Vanilla private CA
- Header, cookie, and X-Forwarded-For rules above are in place
- Public DNS points at Akamai
- Login, assets, and HTTPS all work on the public hostname
CloudFront
- Vanilla has confirmed the vanillacommunities.com origin and public-hostname mapping
- CloudFront origin is that vanillacommunities.com hostname over HTTPS
- Header, cookie, and X-Forwarded-For rules above are in place (Host isyourname.vanillacommunities.com, not the public hostname)
- Alternate domain name and viewer certificate match the public hostname
- Public DNS points at CloudFront
- In-app links use the public hostname, not vanillacommunities.com
For setup questions, contact your Vanilla account team or open a support ticket.