diff --git a/salt/apache/cloudflare.sls b/salt/apache/cloudflare.sls
new file mode 100644
index 000000000..dcde1923f
--- /dev/null
+++ b/salt/apache/cloudflare.sls
@@ -0,0 +1,27 @@
+# https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/
+include:
+  - apache
+  - apache.modules.remoteip
+
+/etc/apache2/conf-available/zz-cloudflare-proxy.conf:
+  file.managed:
+    - contents: |
+        RemoteIPHeader CF-Connecting-IP
+{%- for ip in salt.cmd.run('curl -sS https://www.cloudflare.com/ips-v4/').split() %}
+        RemoteIPTrustedProxy {{ ip }}
+{%- endfor %}
+{%- for ip in salt.cmd.run('curl -sS https://www.cloudflare.com/ips-v6/').split() %}
+        RemoteIPTrustedProxy {{ ip }}
+{%- endfor %}
+    - require:
+      - pkg: apache2
+    - watch_in:
+      - module: apache2-reload
+
+enable-conf-zz-cloudflare-proxy.conf:
+  apache_conf.enabled:
+    - name: zz-cloudflare-proxy
+    - require:
+      - file: /etc/apache2/conf-available/zz-cloudflare-proxy.conf
+    - watch_in:
+      - module: apache2-reload
diff --git a/salt/apache/init.sls b/salt/apache/init.sls
index 1bfd778f6..edc72ce00 100644
--- a/salt/apache/init.sls
+++ b/salt/apache/init.sls
@@ -92,6 +92,7 @@ disable site 000-default.conf:
 #
 # - Do not disclose the Apache version, to avoid false positives about CVE patching.
 # - Do not log uptime monitoring remote requests and Netdata's mod_status requests, to reduce log noise.
+# - Restore original visitor IPs in logs when using a proxy. (%a behaves like the default %h if mod_remoteip isn't configured.)
 #
 # https://httpd.apache.org/docs/2.4/logs.html#conditional
 /etc/apache2/conf-available/zz-customization.conf:
@@ -102,6 +103,8 @@ disable site 000-default.conf:
         SetEnvIf User-Agent AppBeat dontlog
         SetEnvIf User-Agent Pingdom.com_bot dontlog
         SetEnvIf Request_URI "^/server-status$" dontlog
+        LogFormat "%v:%p %a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+        LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
         CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined env=!dontlog
         {{ salt['pillar.get']('apache:customization','') | indent(8) }}
     - require:
diff --git a/salt/top.sls b/salt/top.sls
index 9a320b318..6c0a39b89 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -75,6 +75,8 @@ base:
     - apache.modules.headers
     # Enable HTTPS redirects on the default site.
     - apache.modules.rewrite
+    # Restore original visitor IPs in logs.
+    - apache.cloudflare
 
   # All public web servers should use SSL certificates.
   'I@nginx:public_access:true':