The catalogue
Cloudflare Tunnel
One tunnel on your own Cloudflare account, one route per project, DNS and certificate managed.
- Module
- exposure.cloudflare
- Category
- Exposure
What it installs
- cloudflared as a systemd service, running one tunnel for the machine, with one ingress rule per project that declares a subdomain.
- The DNS record and the certificate, managed for you by Cloudflare, on a subdomain taken from the project registry.
- A marker saying this module holds the machine’s exposure, and a check that the tunnel really came up before the install is called done.
What it asks you for
- A Cloudflare API token, once, for the account rather than for a server. The app checks it as you paste it, reads which account it opens and which zones it carries, and keeps it in your computer’s keychain. You copy no identifier by hand.
- The domain this server publishes under, chosen among those zones. It is a per-server field: the account is shared, the domain is not.
Good to know
Your token never leaves your computer: the app creates the tunnel and writes the DNS, and your server only ever receives what it needs to run that one tunnel. A tunnel is an outbound connection: it opens no port on your server, and the firewall stays closed on everything but SSH. This module and Caddy contradict each other — a machine has one exposure, or none.