Cloudflare nginx allow/deny

# WARNING: log_format must be in http {}.
# http://nginx.org/en/docs/http/ngx_http_core_module.html#var_http_
log_format cloudflare '$http_cf_connecting_ip - $remote_user [$time_local] "$request" '
    '$status $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';
server {
    ...
    #!!!DO NOT USE!!! set_real_ip_from & real_ip_header;
    allow 1.1.1.1;  # Cloudflare front ip1.
    allow 1.1.1.2;  # Cloudflare front ip2.
    deny all;
    ...

    location /application {
        fastcgi_param REMOTE_ADDR $http_cf_connecting_ip;
        ....
    }
}