Hi,
Im holding a bucket with thousands of of small files (3dTiles for map streaming viewer).
I want to keep my raw data secure so that its accesible only through my app.
I dont want to proxy the files through my own software or implement a temporary signed url for each individual file. That creates a wastfull overhead and looses the whole benefit of CDN , cache, loadbalancing etc.
Right now I’ve set a CDN with CloudFlare and applied a firewall over there so that only my app can access the cdn url.
But if somehow the url from digitalocean leaks all my files are readble.
Is there a way to set up a kind of firewall to allow only calls from the subdomain set by the cdn?
That way I can leverage the firewall in the subdomain
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
You’re on the right track by using Cloudflare’s firewall, but to fully secure your DigitalOcean Spaces bucket without using access keys, you need to restrict access at the bucket level.
First, set your bucket permissions to private in DigitalOcean Spaces so files cannot be accessed publicly by default. Then, use Cloudflare’s origin rules to allow only requests coming from your app’s domain or a specific referrer, preventing direct access to the bucket URL. While you mentioned not wanting to generate temporary signed URLs for every file, you can optimize this by batching URL signatures or using Cloudflare Workers to generate them dynamically when needed.
DigitalOcean Spaces does not support request filtering based on domain headers, but you can mitigate exposure by disabling direct public access and only serving files via Cloudflare.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.