Set the SSL mode to “Full”. Then go to “Rules” and create three rules. This is also the order in which they should be processed: 1. Name: lemmy u all Custom filter expression: URI path equals /u/* All other options disabled.

Name: lemmy nodeinfo all Custom filter expression: URI path equals /nodeinfo/* All other options disabled.

Name: lemmy inbox all Custom filter expression: URI path equals /inbox/* All other options disabled.

This should get your instance running behind Cloudflare’s tunnel.