DEV Community: Kamil Kujawiński

n8n caching - One node, no external storage dependencies, easy to use.

Kamil Kujawiński — Sun, 21 Jun 2026 17:54:01 +0000

Plenty of n8n workflows repeat the same expensive step over and over: calling a rate-limited API, scraping a page, or — increasingly — paying an LLM to summarise the same input twice. The fix is the oldest trick in computing: cache the result the first time, and on every later run hand back the stored copy instead of redoing the work.

n8n recently shipped data tables, a built-in per-instance store of typed rows and columns. It's a durable storage that can be reused for cache needs, but wiring up "look it up, branch on hit/miss, write it back, and expire stale entries" by hand is fiddly and easy to get subtly wrong.

So I packaged it as a community node: n8n-nodes-datatable-cache. It's a read-through / write-back cache backed by a data table, with hit/miss routing and TTL expiry built in.

What it does

The node has two inputs (Input, Update) and two outputs (Cache Hit, Cache Miss), designed to be wired as a loop:

 Input  ─▶ ┌─ Data Table Cache ─┐ ─▶ Cache Hit  → use payload
           └────────────────────┘ ─▶ Cache Miss → work ─┐
                ▲──────────────── Update ───────────────┘

Input looks up an item by key. A fresh hit emits the cached payload on Cache Hit; a miss (or an expired hit) emits the item on Cache Miss, with the stale row attached under _staleRow.
Cache Miss → your expensive work → the Update input. The Update input upserts each processed item and re-emits it on Cache Hit.
Take Cache Hit onward as your "I have the data" path.

The net effect: the expensive branch only runs on a miss, and everything downstream of Cache Hit sees a consistent payload whether it came from cache or was just computed.

Requirements: an n8n version whose public API serves /api/v1/data-tables (older instances return 404), and executionOrder: v1 — the default on recent n8n.

Setup (once per instance)

These four steps are a one-time thing per n8n instance. After that, every new workflow just reuses the table and credential.

1. Install the community node

Go to Settings → Community Nodes → Install and enter n8n-nodes-datatable-cache.

You now have a Data Table Cache node in the node panel.

2. Create the cache data table

Each cached item is one row. The schema is four columns (n8n adds id, createdAt, updatedAt automatically):

Column	Type	Required?	Holds
`cache_key`	String	Yes	The lookup key (a record id, a hash…)
`payload`	String	Yes	`JSON.stringify` of the cached item
`last_modified`	Datetime (or String)	Yes	Timestamp of the last write — the default TTL source
`last_access`	Datetime (or String)	Optional	Timestamp of the last hit — only for idle TTL / LRU

The fastest way to get all four columns right is to import a CSV with the correct header row. Download cache-table.csv:

cache_key,payload,last_modified,last_access
example-key,"{""value"":""hello"",""count"":42}",2026-06-20T12:00:00.000Z,2026-06-20T12:00:00.000Z

In Data tables → Create, name the table, choose Import CSV, pick the file, and keep "My CSV file contains a header row" ticked:

On the next screen, confirm the column types — cache_key and payload are String, last_modified and last_access are Datetime — then Create:

A couple of things worth knowing:

payload must be String. A json-typed column breaks the JSON.stringify / JSON.parse round-trip — hits come back as { "_raw": ... }.
Timestamps can be Datetime or String. The node writes ISO-8601 UTC and reads it back as UTC either way, so TTL stays correct.
last_access is optional. A minimal table is just cache_key + payload + last_modified; add last_access only if you want idle-time (last-access) expiry.

Delete the seeded example-key row once the table exists, and copy the table's ID from the URL — you'll paste it into the node.

3. Create an n8n API key

The node reads and writes the data table through n8n's own public API, so it needs an API key with data-table scopes. Go to Settings → n8n API → Create an API key and grant: dataTable:list, dataTableRow:read, dataTableRow:upsert, dataTableRow:update.

4. Create the n8n API credential

Under Credentials → New → n8n API, fill in:

API Key — the key from step 3.
Base URL — your instance URL ending in /api/v1, e.g. https://your-n8n-host/api/v1.

Save it; you should see "Connection tested successfully".

A 404 when the node opens its Data Table dropdown almost always means the Base URL is missing /api/v1, or your n8n version predates the public data-table API.

Using it in a workflow

Import the example

The quickest way to see the loop is to import a working example. Download example-workflow.json and bring it in via Workflows → Import from File:

It's the full read-through / write-back loop in four nodes:

Webhook ─▶ [Input] Data Table Cache [Cache Hit] ─▶ Respond to Webhook
                                    [Cache Miss] ─▶ Heavy processing
                                                          │
                        [Update] ◀────────────────────────┘

A request comes in on the Webhook, gets looked up, and a fresh hit responds immediately. A miss flows through the Heavy processing node (stand in your real API call, scrape, or LLM step here) and back into Update, which stores the result and re-emits it on Cache Hit so the response path is identical either way.

If the import errors with "unknown node type", you skipped step 1 — install the community node and reload.

Configure the node

Open the Data Table Cache node and set the credential, the table, and the key:

Parameter	Default	Notes
Data Table	—	Pick from the list or paste the table ID
Key Column	`cache_key`	Column matched against the cache key
Cache Key	—	Value to look up (Input) or store under (Update)
Payload Column	`payload`	Holds the JSON-stringified payload
Last Modified Column	`last_modified`	ISO timestamp of the last write
Last Access Column	`last_access`	ISO timestamp of the last hit (leave empty to skip)
Max Age + Unit	`3600` s	A hit older than this becomes a miss
Measure From	`Last Modified`	Whether TTL counts from `last_modified` or `last_access`

The column names default to match the table from setup, so you normally leave them alone. The one field you always set is Cache Key — derive it from something present on both the lookup item and the processed item, e.g. ={{ $json.query.key }}.

One item = one JSON object, not an array. n8n passes items individually, so the Update input stores a single item's $json per key, and Cache Hit emits that same object. To cache a collection under one key, wrap it first (e.g. { "items": [...] }) so it travels as a single item.

TTL and expiry

Max Age + Unit is how long a hit stays fresh; older hits route to Cache Miss.
Measure From Last Modified is time since the value was cached — what most caches want, and it needs no last_access column.
Measure From Last Access is time since it was last read — combine it with a scheduled cleanup for LRU-style eviction. This mode requires the Last Access Column to be set.

Keep the table pruned

Data tables don't auto-delete expired rows, so the table grows until you prune it. Add a separate scheduled workflow — a Schedule Trigger into a built-in Data Table node (operation Delete Rows) pointed at the same table, filtering last_modified less than a cutoff like ={{ $now.minus({ days: 7 }).toUTC().toISO() }}. Because the timestamps are ISO-8601, a less-than comparison sorts them chronologically. (This cleanup uses the plain Data Table node, so it needs no API key.)

All data tables in an instance share a default 50 MB limit, so keep payloads compact (N8N_DATA_TABLES_MAX_SIZE_BYTES raises it on self-hosted).

Good to know

Expiry is TTL-only for now (filter-condition mode is planned).
Concurrency is last-write-wins — perfectly fine for a cache, not for transactional data.
Malformed payloads degrade to { _raw: <value> } rather than throwing.
With Continue On Fail on, errored items are emitted with an error field instead of failing the run (lookup errors go to Cache Miss, store errors to Cache Hit).

The node is MIT-licensed and on npm as n8n-nodes-datatable-cache. Drop it into the next workflow that's redoing expensive work on every run.

Originally published at digit11.com.

Turn a Google Sheet Into an iPhone and Apple Watch Widget

Kamil Kujawiński — Sun, 07 Jun 2026 20:25:17 +0000

A spreadsheet is where most of us already track the small numbers of life: the home budget, the side-project revenue, the litres of fuel, the kilometres run. The annoying part is that the number only exists when you open the sheet. You can't glance at it.

This post closes that gap. With two pieces you get any Google Sheet on your iPhone home screen and Apple Watch face:

A small n8n workflow that reads your sheet, keeps only the columns you care about, computes the aggregations you ask for (total, average, per-owner breakdown…), and exposes it as a JSON webhook.
The API Widgets iOS app, which reads that webhook and renders it as a widget.

We'll build a shared household budget widget as the worked example - a donut of who's saving how much, next to a table of where the money went - but nothing in the workflow is budget-specific. Swap the sheet and the config and you have a sales dashboard, a fitness tracker, or a fuel log.

How it works

Download the workflow and import it into your n8n instance.

It's only five nodes:

Webhook - exposes the endpoint GET /webhook/sheets.
Configuration - a Code node that returns which sheet to read and what to compute.
Get row(s) in sheet - pulls every row from the Google Sheet.
Spreadsheet to JSON - keeps the configured columns and runs the aggregations.
Respond to Webhook - returns the result as JSON.

There is no caching and no database. Every call to the webhook reads the sheet live and returns the current numbers. That keeps the workflow trivial to set up - nothing to provision, no stale data to reason about. If you ever put this in front of heavy traffic, that's the point where you'd add a cache.

Step 1: the Google Sheet

Make a sheet with a header row and one row per record. For the shared-budget example, the columns are category, budget, spent, left, and owner:

In n8n, create a Google Sheets credential (OAuth2) and give it access to this sheet. The Get row(s) in sheet node uses that credential; the sheet itself is identified by its document ID - the long string in the sheet URL between /d/ and /edit. That ID isn't typed into the node directly; it comes from the Configuration node (next step), so pointing the workflow at a different sheet is a one-line change.

Step 2: where you configure it

This is the part that replaces the database in fancier setups: the Configuration node. It's a plain Code node that returns three things - the sheet to read, the columns to keep, and the aggregations to compute. Open it and edit the values:

return {
  source: "YOUR_GOOGLE_SHEET_ID",
  columns: [
    { "position": 0, "header": "category", "type": "text" },
    { "position": 1, "header": "budget",   "type": "number" },
    { "position": 2, "header": "spent",    "type": "number" },
    { "position": 3, "header": "left",     "type": "number" },
    { "position": 4, "header": "owner",    "type": "text" }
  ],
  aggregations: [
    { "name": "savings",          "group_by": "owner", "field": "left",  "agg": "sum" },
    { "name": "responsibilities", "group_by": "owner", "field": "owner", "agg": "count" }
  ]
};

source - paste your Google Sheet document ID here.
columns - the headers to keep, in order. header must match the column name in the sheet row for row.
aggregations - the summaries to compute. Each one supports sum, avg, min, max, and count. Add group_by to get a value per distinct group instead of one overall number, and name is the key it shows up under in the response.

The example asks for two numbers per person: savings (the sum of each owner's left column) and responsibilities (how many budget categories each owner is on the hook for).

Step 3: the transform

The Spreadsheet to JSON Code node reads the configuration, picks the requested columns out of every row, and runs the aggregations:

const columns = $('Configuration').first().json.columns;
const aggregations = $('Configuration').first().json.aggregations;

const items = $input.all().map((item) => {
  const row = item.json;
  const out = {};
  for (const col of columns) {
    out[col.header] = row[col.header];
  }
  return out;
});

const aggregators = {
  sum: (vals) => vals.reduce((a, b) => a + Number(b || 0), 0),
  avg: (vals) => (vals.length ? vals.reduce((a, b) => a + Number(b || 0), 0) / vals.length : 0),
  min: (vals) => (vals.length ? Math.min(...vals.map(Number)) : null),
  max: (vals) => (vals.length ? Math.max(...vals.map(Number)) : null),
  count: (vals) => vals.length,
};

const aggResult = {};
for (const agg of aggregations) {
  const fn = aggregators[agg.agg];
  const outKey = agg.name || agg.field;

  if (agg.group_by) {
    const grouped = {};
    for (const item of items) {
      const key = String(item[agg.group_by]);
      (grouped[key] ||= []).push(item[agg.field]);
    }
    const groupOut = {};
    for (const [key, vals] of Object.entries(grouped)) {
      groupOut[key] = fn(vals);
    }
    aggResult[outKey] = groupOut;
  } else {
    aggResult[outKey] = fn(items.map((i) => i[agg.field]));
  }
}

return [{ json: { items, aggregations: aggResult } }];

For the sheet above, the response looks like this:

{
  "items": [
    { "category": "Groceries",     "budget": "600", "spent": "412.5",  "left": "187.5", "owner": "Ann" },
    { "category": "Restaurants",   "budget": "200", "spent": "250",    "left": "-50",   "owner": "Ann" },
    { "category": "Transport",     "budget": "150", "spent": "92.1",   "left": "57.9",  "owner": "Robert" },
    { "category": "Utilities",     "budget": "300", "spent": "287.4",  "left": "12.6",  "owner": "Robert" },
    { "category": "Entertainment", "budget": "150", "spent": "64",     "left": "86",    "owner": "Ann" },
    { "category": "Shopping",      "budget": "200", "spent": "143.8",  "left": "56.2",  "owner": "Ann" },
    { "category": "Health",        "budget": "100", "spent": "45",     "left": "55",    "owner": "Ann" },
    { "category": "Subscriptions", "budget": "80",  "spent": "79.99",  "left": "0.01",  "owner": "Robert" },
    { "category": "Other",         "budget": "300", "spent": "156.7",  "left": "143.3", "owner": "Ann" }
  ],
  "aggregations": {
    "savings": { "Ann": 478, "Robert": 70.51 },
    "responsibilities": { "Ann": 6, "Robert": 3 }
  }
}

items is the raw table; aggregations is the computed summary. The widget can show either - the per-owner savings as a chart, or the full items table as a list. We'll use both.

Step 4: wire it up to API Widgets

Install API Widgets on your iPhone.

In the Source tab, paste the webhook URL:

https://n8n.example.com/webhook/sheets

Then switch to the Design tab. For this budget we use the Split widget type - two panes side by side, bound to two parts of the JSON:

Left column → Pie, with the Data Source expression ${api['aggregations']['savings']} - the donut of savings per owner.
Right column → Table, with the Source expression ${api['items']} - the list of categories and what was spent.

The expression language reaches straight into the JSON the workflow returns, so anything you put under items or aggregations is one expression away from being on screen.

Final result

Tap the preview (the eye icon) and you can see the finished widget right in the app before placing it - the savings donut for Ann and Robert next to the spending table:

Add it to your home screen as usual, and the same layout works on the Apple Watch face (the watch widget requires the pro version of API Widgets).

The sheet stays the single source of truth - edit a row, and the next time the widget refreshes, your wrist catches up. Swap the sheet ID and the Configuration node, and the same workflow serves any number you keep in a spreadsheet.

Originally published at digit11.com.

Search Sofascore from Your Browser's Address Bar

Kamil Kujawiński — Tue, 21 Apr 2026 21:21:18 +0000

Sofascore browser search - GIF example

I watch a lot of football and I'm constantly looking things up on Sofascore. Opening the site, clicking the magnifier, typing — it adds up. What I want is: type sofa barcelona in my address bar, hit Enter, land on the search results.

Sofascore's URL doesn't accept a ?q= parameter natively, and the search input is a React-controlled field that ignores programmatically-set values. Getting from the address bar to a live Sofascore search takes three pieces:

A browser keyword shortcut that routes sofa <query> to Sofascore with the query attached as ?q=
A Tampermonkey userscript that reads ?q= on page load and feeds it into the search box
A local typing service that actually types the query, key by key, because the React input won't accept anything less

1. Add the browser keyword

Chrome (and any Chromium browser) supports address-bar search keywords. Add one pointing at Sofascore:

Open chrome://settings/searchEngines
Click Add under "Site search"
Set:
- Name: Sofascore
- Shortcut: sofa
- URL: https://www.sofascore.com/pl/?q=%s

Firefox and Safari have equivalent settings — the important part is the %s placeholder, which the browser replaces with whatever you typed after the keyword.

Now typing sofa barcelona in the address bar navigates to https://www.sofascore.com/pl/?q=barcelona. Sofascore itself ignores the ?q=; the userscript picks it up from there.

2. Userscript: turn ?q= into a real search

Install Tampermonkey, then add this script:

// ==UserScript==
// @name         Websearch for Sofascore
// @namespace    https://digit11.com/
// @version      1.0.0
// @description  Forward ?q= search terms into Sofascore's search input via Real Type
// @author       kkujawinski
// @match        https://www.sofascore.com/*
// @icon         https://www.google.com/s2/favicons?sz=64&domain=sofascore.com
// @grant        none
// ==/UserScript==

(function() {
    'use strict';

    const TYPING_SERVER_URL = 'http://localhost:8765';

    async function realType(text, options = {}) {
        const {
            delay = 2,
            focusFirst = true
        } = options;

        // Focus the current element if requested
        if (focusFirst && document.activeElement) {
            document.activeElement.focus();
        }

        // Small delay to ensure focus
        await new Promise(resolve => setTimeout(resolve, 100));

        // Send to macOS typing service
        try {
            const response = await fetch(TYPING_SERVER_URL + '/type', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                },
                body: JSON.stringify({ text, delay })
            });

            if (!response.ok) {
                throw new Error(`Server responded with ${response.status}`);
            }

            const result = await response.json();
            console.log('Typing completed:', result);
            return result;
        } catch (error) {
            console.error('Failed to connect to typing service:', error);
            console.log('Make sure the macOS typing service is running on port 8765');
            throw error;
        }
    }


    function getQueryParam(name) {
        const urlParams = new URLSearchParams(window.location.search);
        return urlParams.get(name) || '';
    }

    const searchValue = getQueryParam('q').replace(/\/+$/, '');
    if (searchValue) {
        (async function simulateFocusClickLoop() {
            let input;
            let maxAttempts = 50;
            while (!(input = document.querySelector('input#search-input'))) {
                maxAttempts--;
                if (maxAttempts === 0) {
                    break;
                }
                await new Promise(r => setTimeout(r, 10));
            }

            maxAttempts = 100;
            while (!(document.querySelector('.z_dropdown input[type="radio"][name="all"]'))) {
                maxAttempts--;
                if (maxAttempts === 0) {
                    break;
                }
                console.log('focusing...');
                input.focus();
                input.click();
                await new Promise(r => setTimeout(r, 10));
            }
            await new Promise(r => setTimeout(r, 30));
            await realType(searchValue);
            // input.value = searchValue;
            // input.dispatchEvent(new InputEvent('input', { bubbles: true }));
        })();
    }
})();

The script:

Reads the q query parameter (with a trailing-slash guard for browsers that append one).
Polls for input#search-input to appear, then focuses and clicks it in a loop until the search dropdown (.z_dropdown input[type="radio"][name="all"]) shows up — Sofascore's signal that the input is ready to accept keystrokes.
Calls realType(searchValue), which forwards the query to a local typing server.

Why not just input.value = searchValue? That's the commented-out line at the bottom — it's what you reach for first, and it doesn't work. React's controlled-input handlers ignore the direct assignment, and dispatching a synthetic InputEvent gets filtered out too. The search input stays empty.

The typing server exists for exactly this reason. That's the last piece.

3. Real Type — typing like a real keyboard

Repo: kkujawinski/real-type-server

The AppleScript doing the work

The core is a handful of AppleScript lines driving System Events:

tell application "System Events"
    repeat with i from 1 to length of textToType
        set currentChar to character i of textToType
        keystroke currentChar
        delay charDelay
    end repeat
end tell

keystroke is the important bit. Unlike pasting or setting a field's value, it emits events indistinguishable from a real keyboard. The target app sees key-down / key-up events arriving at human pace, so input validators, focus handlers — all of it just works. Sofascore's React input included.

The standalone macos-typer.applescript file wraps this loop so you can invoke it directly:

osascript macos-typer.applescript "hello world" 50

A tiny Python server in front

To make the typer callable from a browser userscript — or a shell alias, or another machine on localhost — there's a thin Python HTTP server (osascript-typing-server.py) on port 8765. It's http.server from the stdlib, no dependencies.

It accepts one route, POST /type, reads { "text", "delay" } from the JSON body, escapes the text for AppleScript, shells out to osascript -e …, and returns a JSON status. You can call it straight from a webpage — exactly what the userscript does.

curl -X POST http://localhost:8765/type \
  -H 'Content-Type: application/json' \
  -d '{"text": "Hello, world!", "delay": 50}'

That's the whole server. The value isn't in the Python — it's in giving the AppleScript a stable local endpoint.

Autostart at login

install-autostart.sh writes a LaunchAgent plist to ~/Library/LaunchAgents/ and launchctl loads it. From then on the server boots with your user session, restarts automatically if it crashes, and logs to /tmp/osascript-typing-server.log. One-time setup: grant Accessibility permission to the Python binary the installer reports, otherwise keystroke silently no-ops.

uninstall-autostart.sh and check-status.sh handle the rest of the lifecycle.

Full source, install scripts, and the LaunchAgent plist are in the repo.

Putting it together

With the three pieces in place, the flow is:

Type sofa barcelona in the address bar, hit Enter.
Browser navigates to https://www.sofascore.com/pl/?q=barcelona.
Userscript waits for the search input to be ready, then hands the query off to the typing server.
Real Type types barcelona into the focused field at human pace.
Sofascore's search dropdown fills with live results.

The same pattern works for any site whose search resists synthetic input — swap the selector and the keyword URL, and you've got another shortcut.

Monitor Google Cloud Platform Costs on Your iPhone and Apple Watch

Kamil Kujawiński — Mon, 23 Mar 2026 18:51:37 +0000

Keep an eye on your GCP costs right from your wrist. Don't let autoscaling silently run up your bill — stay informed with a quick glance at your iPhone or Apple Watch.

Here's the plan:

Configure GCP billing export to a BigQuery table
Create an n8n workflow that queries BigQuery for cost data
Set up a widget in API Widgets to display the results

Configure GCP Billing Export to BigQuery

1. Enable the BigQuery API in GCP

2. Enable billing export to BigQuery

3. Create a service account for BigQuery access

gcloud iam service-accounts create n8n-bigquery-reader \
  --display-name="n8n BigQuery Reader" \
  --project=YOUR_PROJECT_ID

4. Assign minimal permissions

The service account needs just two roles:

bigquery.jobUser — allows running queries
bigquery.dataViewer — allows reading tables and views (read-only)

# Allow running queries and reading results
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:n8n-bigquery-reader@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/bigquery.jobUser"

# Allow reading data from datasets and tables
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:n8n-bigquery-reader@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/bigquery.dataViewer"

5. Generate a service account key for n8n

gcloud iam service-accounts keys create n8n-bigquery-key.json \
  --iam-account=n8n-bigquery-reader@YOUR_PROJECT_ID.iam.gserviceaccount.com

This generates a n8n-bigquery-key.json file containing the service account credentials. You'll use this file to authenticate the BigQuery node in n8n.

Set Up the n8n Workflow

The workflow exposes a webhook endpoint that API Widgets can call. When triggered, it queries BigQuery for your billing data, groups costs by date and service, and returns the results as JSON.

The workflow consists of five nodes:

Webhook — listens for incoming requests (accepts an optional days query parameter, defaults to 14)
Configure variables — sets the BigQuery table name and the number of days to query
Execute BigQuery — runs a SQL query that aggregates daily costs by service
Format data — transforms the results into a structured JSON response with daily totals and per-service breakdowns
Respond to Webhook — sends the formatted data back to the caller

You can import the workflow into your n8n instance using the JSON file: GCP Billing costs.json. Make sure to update the table_name variable in the "Configure variables" node to match your BigQuery billing export table.

Configure API Widgets

1. Download API Widgets from the App Store.

2. Create a new widget and configure the API endpoint in the Source tab, pointing it to your n8n webhook URL.

3. Set up the visualization in the Design tab.

4. Add a home screen widget and link it to the one you just created.

The widget also works on Apple Watch — view your costs at a glance from your wrist:

Using Cloudflare SSL with Elastic Beanstalk instances

Kamil Kujawiński — Sat, 04 Jan 2025 16:06:04 +0000

Motivation:

To obtain a free SSL certificate (by Let's Encrypt) for your web application without the hassle of renewing it every three months, consider the following approach.

The simplest solution is to use a Load Balancer and attach an SSL certificate from AWS Certificate Manager (ACM) to it. However, relying on a Load Balancer solely for HTTPS may be costly. To address this, I’ve outlined a much more affordable alternative that requires a bit of configuration.

Additionally, in this post, I explain how to configure SSL for an Elastic Beanstalk instance, as I found the existing documentation and available resources to be somewhat outdated.

Keyword of the solution is Cloudflare.

Cloudflare offers a proxy feature that enables you to set up a free SSL certificate while securely proxying traffic to your host.

In Flexible mode, the communication between Cloudflare and AWS is not encrypted. If you prefer end-to-end encryption, you can opt for Full mode instead.

Steps

1. Add your domain to Cloudflare.

In the DNS settings, configure your domain as proxied.
In the SSL/TLS settings, select Full (strict) mode for end-to-end encryption.

2. Generate an Origin Certificate in Cloudflare

Go to the SSL/TLS > Origin Server section in Cloudflare.
Generate a certificate valid for up to 15 years.
Use this certificate to configure SSL in AWS Elastic Beanstalk.

3. Store Certificates in AWS Secrets Manager:

Save the server.crt and server.key files as secrets in AWS Secrets Manager.
Use the following secret names: /app/ssl/server-crt and /app/ssl/server-key

4. Grant IAM Role Access to Secrets:

In AWS IAM add a new policy named ReadSSLSecretKeys for the role aws-elasticbeanstalk-ec2-role with the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ssm:GetParameter",
      "Resource": "arn:aws:ssm:region:account_id:parameter/app/ssl/server-crt"
    },
    {
      "Effect": "Allow",
      "Action": "ssm:GetParameter",
      "Resource": "arn:aws:ssm:region:account_id:parameter/app/ssl/server-key"
    }
  ]
}

5. Configure your Elastic Beanstalk deployment to listen on port `443` and use the Origin Certificate generated in Cloudflare (stored in AWS Secrets Manager) do changes in the following files:

.ebextensions/01_https-instance-securitygroup.config

Resources:
  sslSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

.ebextensions/02_https-instance.config

files:
  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN CERTIFICATE-----
      certificate file contents
      -----END CERTIFICATE-----

  /etc/pki/tls/certs/server.key:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN RSA PRIVATE KEY-----
      private key contents # See note below.
      -----END RSA PRIVATE KEY-----

container_commands:
  01_fetch_server_crt:
    command: |
      aws ssm get-parameter --name "/app/ssl/server-crt" --with-decryption --query "Parameter.Value" --output text > /etc/pki/tls/certs/server.crt
  02_fetch_server_key:
    command: |
      aws ssm get-parameter --name "/app/ssl/server-key" --with-decryption --query "Parameter.Value" --output text > /etc/pki/tls/certs/server.key

.platform/nginx/conf.d/https.conf

server {
    listen 443 ssl;

    ssl_certificate /etc/pki/tls/certs/server.crt;
    ssl_certificate_key /etc/pki/tls/certs/server.key;

    ssl_session_timeout 5m;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    location / {
      proxy_pass http://127.0.0.1:8000;
      proxy_http_version 1.1;

      proxy_set_header Connection "";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
    }
}