Proxy issue with cloudflare reverse proxy static assets

Bug Description

Hi, I have been running posthog with a pretty standard next.js reverse proxy setup, but I noticed that in the last month-ish my session recordings haven't been working. It turns out that Cloudflare seems to be blocking cloudflare-to-cloudflare connections, and I'm seeing 403 issues when requesting things e.g. https://<my-domain>/ingest/static/posthog-recorder.js?v=1.372.1

I don't fully understand the issue tbh, but I haven't changed anything about this configuration since it stopped working about 12d ago, so wondering if this might be something on y'alls end. I fixed it by removing the reverse proxy for the static assets.

import type { NextConfig } from "next";
import { config } from "dotenv";
import path from "path";

// Load env from repo root
config({ path: path.resolve(__dirname, "../.env.local") });

const nextConfig: NextConfig = {
  async rewrites() {
    return [
      {
        source: "/ingest/decide",
        destination: "https://us.i.posthog.com/decide",
      },
      {
        source: "/ingest/static/:path*",
        destination: "https://us-assets.i.posthog.com/static/:path*",
      },
      {
        source: "/ingest/:path*",
        destination: "https://us.i.posthog.com/:path*",
      },
    ];
  },
  skipTrailingSlashRedirect: true,
};

export default nextConfig;

Debug info

- [ ] PostHog Cloud, Debug information: [please copy/paste from https://us.posthog.com/settings/project-details#variables or https://eu.posthog.com/settings/project-details#variables]
- [ ] PostHog Hobby self-hosted with `docker compose`, version/commit: [please provide]
- [ ] PostHog self-hosted with Kubernetes (deprecated, see [`Sunsetting Kubernetes support`](https://posthog.com/blog/sunsetting-helm-support-posthog)), version/commit: [please provide]

Start with the reported Next.js nextConfig.rewrites() entry point, especially /ingest/static/:path*, and reproduce the request to /ingest/static/posthog-recorder.js?v=1.372.1 through the described reverse proxy. Compare the static-asset route with the other rewrite destinations and verify that the asset no longer returns a 403 when proxied through Cloudflare.