Deliver Private Backblaze B2 Content Through Cloudflare CDN

Cloudflare Workers enable serverless functions to run as close as possible to the end user. For more information about how you can use Cloudflare Workers with your Backblaze B2 Cloud Storage account, click here.

You can use Cloudflare Workers to serve data from a private Backblaze B2 Cloud Storage bucket. To allow Cloudflare to fetch content from a public Backblaze B2 bucket, click here.

You can use Backblaze B2 to host static data for your website (for example, minified Javascript applications or multi-hour 8K videos) securely, reliably, and affordably. One solution to ensure performance and availability is to route requests through a CDN (content delivery network) such as a Backblaze Bandwidth Alliance partner Cloudflare. You can take advantage of Cloudflare's performance and the free data transfer between Backblaze B2 and Cloudflare.

CDN Functionality

Cloudflare uses a DNS (domain name system) so that content requests reach Cloudflare's servers. Through caching and private high-speed links, Cloudflare ensures high availability and reliability from storage. A website's domain name is registered with Cloudflare (and transferred from its domain name registrar) so that Cloudflare becomes responsible for serving content from that domain. Behind the scenes, Cloudflare allows a website's domain to be aliased to some other domain so that a user can see images and content from, for example, https://www.coffeemaniacs.com when those images and that content is actually being served from Backblaze B2 (for example, https://f345.backblazeb2.com/file/coffemaniacs-storage).

Private Backblaze Buckets

Although all buckets are addressable from the Internet, only public buckets can be accessed by anyone. By default, Backblaze B2 storage is private, which means that access requires authentication. Backblaze's various integration partners incorporate this security into their tools to keep Backblaze B2 as user-friendly as possible while still maintaining security.

Website Content from Secure Buckets

Putting these elements together means that you can serve data from your website and store your photos, videos, and all digital content in a private bucket, available through (and only through) your website. When hosting a website directly, adding the authentication required to pull data from Backblaze B2 is straightforward. Fronting a website through Cloudflare is slightly more complex; now Cloudflare must access private buckets to retrieve and cache data, which means Cloudflare must authenticate its requests to Backblaze B2.

Before you begin, complete the following tasks:

• Sign up for a Cloudflare Workers account. You can publish Workers to the default *.workers.dev subdomain free of charge, or you can publish Workers to your own paid domain.
• Install and configure wrangler, the Workers command-line interface (CLI).

Enable Backblaze B2

Create a Bucket

Create an Application Key

Create a Cloudflare Worker

The Backblaze B2 GitHub repository contains full source code and configuration details for Cloudflare Workers.

1. Start a project in the Workers CLI using the Backblaze repository as a template for your own Worker.
2. Run the following commands changing the Worker name, shown in the example as my-proxy, to your project name:

wrangler generate my-proxy https://github.com/backblaze-b2-samples/cloudflare-b2
cd my-proxy

Configure Your Cloudflare Worker

Before you begin: Create a private bucket in your Backblaze B2 account. If the bucket you want to use is public, do not change this setting until you set up your Worker.

1. Edit the wrangler.toml file, adding a [vars] section with your application key ID and endpoint:

   [vars]
   B2_APPLICATION_KEY_ID = ""
   B2_ENDPOINT = ""
   BUCKET_NAME = ""
   ALLOW_LIST_BUCKET = ""

2. Enter your bucket name using one of the following options:
   • To direct all incoming requests to the specified bucket, use the format acme-images.
   • To use the initial segment in the incoming URL path as the bucket name, enter $path, for example:

     https://images.acme.com/acme-images/logos/acme.png

     Note: If you use the default *.workers.dev subdomain, specify a bucket name in the configuration, or set BUCKET_NAME to $path and pass the bucket name in the path.
   • To use the initial subdomain in the incoming URL hostname as the bucket name, enter $host, for example:

     https://acme-images.images.acme.com/logos/acme.png

     Note: If you set BUCKET_NAME to $host, configure a Route or a Custom Domain for each bucket name that the Workers must access. You cannot route *.acme.com/* to your Workers.
3. Set the ALLOW_LIST_BUCKET variable to either true or false.
   Backblaze B2 buckets, even those that are public, do not allow anonymous clients to list the bucket’s objects. Set the ALLOW_LIST_BUCKET variable to true to allow this functionality. Set the variable to false, to deny this functionality. In most cases, you should set ALLOW_LIST_BUCKET to false.
4. Run the following command to publish the Workers project to the Cloudflare Workers environment:

   wrangler publish

Deploy Your Worker

1. Sign in to your Cloudflare dashboard, and navigate to your new Worker.
2. Click Settings, click Variables, and click Edit Variables.
3. Add a variable named B2_APPLICATION_KEY, and enter your Backblaze B2 application key as the value.
   Backblaze recommends that you set your Backblaze B2 app key here instead of in wrangler.toml.
   You should never save secrets such as API keys, passwords, and other sensitive data in source code files in the event that they are shared privately or in a public repository.
4. Click Encrypt, and click Save and deploy.

The environment variables should look like the following example:

Update Your Web Pages

You must update your code to reference your Cloudflare Worker rather than the Backblaze B2 bucket. For example, replace all occurrences of acme-images.s3.us-west-001.backblazeb2.com with images.acme.com.

Set Bucket Information

Since the bucket is private, the Cloudflare Worker signs each request to Backblaze B2 using the application key, and it includes the signature in the request’s authorization HTTP header. By default, Cloudflare does not cache content when the request contains the authorization header. Therefore, you must set your bucket’s info to include a cache-control directive.

1. Sign in to your Backblaze account.
2. In the left navigation menu under B2 Cloud Storage, click Buckets.
3. Locate your bucket in the list, and click Bucket Settings.
4. Enter {"Cache-Control":"public"} in the Bucket Info field.
   Optionally, set additional cache-control directives, for example, to direct Cloudflare to cache each file for a day, enter {"Cache-Control": "public, max-age=86400"} in the Bucket Info field.
5. Click Update Bucket.

Set Bucket Visibility

1. Verify that you can access your content using the Worker. For example, open a URL of the form https://images.acme.com/logos/acme.png in a browser.
2. Change the visibility of the public bucket to private.
3. Verify that your content is no longer directly accessible from Backblaze B2. For example, you should no longer be able to access URLs of the form https://acme-images.s3.us-west-001.backblazeb2.com/logos/acme.png.

End users can no longer access your content directly from Backblaze B2.