Take into consideration that even if you use a CDN like CloudFlare, you should still setup HTTPS on your server (either at the ingress level or in the app). That’s because CloudFlare is outside of your cluster, so if the traffic between CloudFlare and your app is not encrypted, you can still be vulnerable to MITM attacks.
Typically, one would use a public certificate on CloudFlare, and a “private” one on the server, setting authenticated origin pulls to make sure that only CloudFlare can connect directly to the server.
That said, back to the original question, there are indeed two approaches:
- Terminating SSL at the Kubernetes ingress level
- Terminating SSL in Phoenix
Doing it at the ingress level might make more sense if you plan to have several apps running on the same cluster, all needing HTTPS.
In both case you need to obtain a key and certificate, for example from Let’s Encrypt (yes, you’ll need a domain name to do that). Unfortunately, the instructions to obtain a valid certificate are simpler to follow if you have control of your webserver (like when you run your own Nginx), but once you obtain it, it’s simple enough to set it up either on the ingress or on Phoenix.
