I observed my Cloudflare firewall events under Security > Events. Cloudflare takes actions against instances that use the Lemmy API through Tor since the launch of my instance. I will allow this traffic to see if that improves federation for my instance, somehow. I doubt it as the vast majority of traffic gets through without a Cloudflare challenge.
Update: WAF rule didn't work. I suspect page rules block the requests before they reach the WAF.
I whitelist everything under the sun as I only have 3 page rules. Lemmy requires the following paths as far as I saw:
- /.well-known/nodeinfo
- /nodeinfo/2.0.json
- /api/v3 and v1
- /pictrs
Update 2: Cloudflare neither blocks nor challenges API requests anymore. But federation is still whack.