diff --git a/flake.lock b/flake.lock
index 428a05f..5f3357c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -51,6 +51,30 @@
         "url": "https://tangled.org/anirudh.fi/atlogin"
       }
     },
+    "cloudflare-ips-v4": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-V4dThTb8iw02hjngubVtSJbEeWgOS1e/ODt1fLjLZvk=",
+        "type": "file",
+        "url": "https://www.cloudflare.com/ips-v4"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://www.cloudflare.com/ips-v4"
+      }
+    },
+    "cloudflare-ips-v6": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-BgpkXCAh/MmK3GTAElKiGJctCYUN+/UgvpuawqGmitE=",
+        "type": "file",
+        "url": "https://www.cloudflare.com/ips-v6"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://www.cloudflare.com/ips-v6"
+      }
+    },
     "colmena": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -709,6 +733,8 @@
     "root": {
       "inputs": {
         "atlogin": "atlogin",
+        "cloudflare-ips-v4": "cloudflare-ips-v4",
+        "cloudflare-ips-v6": "cloudflare-ips-v6",
         "colmena": "colmena",
         "disko": "disko",
         "nixery-flake": "nixery-flake",
diff --git a/flake.nix b/flake.nix
index c848d37..354ed2e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -6,6 +6,14 @@
     tangled.url = "git+https://knot1.tangled.sh/tangled.org/core";
     tangled-mirror.url = "git+https://tangled.org/tangled.org/core?ref=master";
     colmena.url = "github:zhaofengli/colmena/release-0.4.x";
+    cloudflare-ips-v4 = {
+      url = "file+https://www.cloudflare.com/ips-v4";
+      flake = false;
+    };
+    cloudflare-ips-v6 = {
+      url = "file+https://www.cloudflare.com/ips-v6";
+      flake = false;
+    };
     disko = {
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -23,6 +31,8 @@
     nixpkgs,
     disko,
     colmena,
+    cloudflare-ips-v4,
+    cloudflare-ips-v6,
     nixery-flake,
     tangled,
     tangled-mirror,
@@ -32,6 +42,9 @@
     lib = nixpkgs.lib;
     system = "x86_64-linux";
     commonArgs = import ./common/ssh.nix;
+    cloudflareRanges = lib.filter (line: line != "") (lib.concatMap
+      (input: lib.splitString "\n" (builtins.readFile input.outPath))
+      [cloudflare-ips-v4 cloudflare-ips-v6]);
 
     baseModules = [
       disko.nixosModules.disko
@@ -43,7 +56,7 @@
       lib.nixosSystem {
         inherit system;
         specialArgs = {
-          inherit commonArgs;
+          inherit commonArgs cloudflareRanges;
           nixery-pkgs = import nixery-flake.outPath {
             pkgs = import nixpkgs {inherit system;};
           };
@@ -158,7 +171,7 @@
         meta = {
           nixpkgs = nixpkgs.legacyPackages.${system};
           specialArgs = {
-            inherit commonArgs;
+            inherit commonArgs cloudflareRanges;
             nixery-pkgs = import nixery-flake.outPath {
               pkgs = import nixpkgs {inherit system;};
             };
diff --git a/hosts/knot1/services/nginx.nix b/hosts/knot1/services/nginx.nix
index b520a1f..18cf030 100644
--- a/hosts/knot1/services/nginx.nix
+++ b/hosts/knot1/services/nginx.nix
@@ -1,6 +1,23 @@
 {
+  lib,
+  cloudflareRanges,
+  ...
+}: let
+  proxyHeaders = ''
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  '';
+in {
   services.nginx = {
     enable = true;
+
+    commonHttpConfig = ''
+      ${lib.concatMapStrings (range: "set_real_ip_from ${range};\n") cloudflareRanges}
+      real_ip_header CF-Connecting-IP;
+    '';
+
     virtualHosts = {
       "knot1.tangled.sh" = {
         forceSSL = false;
@@ -8,21 +25,12 @@
         locations."/" = {
           proxyPass = "http://127.0.0.1:5555";
 
-          extraConfig = ''
-            proxy_set_header X-Forwarded-For $remote_addr;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-Proto $scheme;
-          '';
+          extraConfig = proxyHeaders;
         };
         locations."/events" = {
           proxyPass = "http://127.0.0.1:5555";
-          extraConfig = ''
-            proxy_set_header X-Forwarded-For $remote_addr;
-            proxy_set_header Host $host;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-          '';
+          proxyWebsockets = true;
+          extraConfig = proxyHeaders;
         };
       };
     };