Cloudflare Tunnel: expose things cleanly

0 of 6 steps done Your ticks stay in this browser.

1. Install cloudflared on the mini-PC

   We go through Cloudflare’s official apt repository, to get updates automatically:

   # Add Cloudflare's GPG key
   sudo mkdir -p --mode=0755 /usr/share/keyrings
   curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg \
     | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
   # Add the repository
   echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main" \
     | sudo tee /etc/apt/sources.list.d/cloudflared.list
   # Install
   sudo apt update && sudo apt install cloudflared
   

   Done Done : Install cloudflared on the mini-PC Have your agent do it

2. Connect cloudflared to your account

   cloudflared tunnel login
   

   This opens your browser. You choose the domain to authorize, and Cloudflare drops a certificate into ~/.cloudflared/. That’s what proves this tunnel has the right to act on your domain.

   Done Done : Connect cloudflared to your account Have your agent do it

3. Create the named tunnel

   cloudflared tunnel create mini
   

   This creates a tunnel called mini and writes a credentials file in JSON (something like ~/.cloudflared/<a-long-id>.json). Note the identifier shown: we need it right after.

   Done Done : Create the named tunnel Have your agent do it

4. Write the config file

   Create ~/.cloudflared/config.yml. It’s the one that says: “traffic from the mini tunnel arriving at such-and-such domain goes to such-and-such local service.”

   tunnel: <your-tunnel-id>
   credentials-file: /home/your-user/.cloudflared/<your-tunnel-id>.json
   
   ingress:
     # myapp.your-domain.com → the app running locally on port 8099
     - hostname: myapp.your-domain.com
       service: http://localhost:8099
     # Everything else gets a 404, required at the end of the list
     - service: http_status:404
   

   The ingress block reads top to bottom. The last line http_status:404 is a required catch-all: without it, cloudflared refuses to start. You can add other hostname entries above it to expose several apps through the same tunnel.

   Done Done : Write the config file Have your agent do it

5. Route the DNS

   cloudflared tunnel route dns mini myapp.your-domain.com
   

   This command creates the DNS record at Cloudflare that points your subdomain to the tunnel. Once per hostname.

   Done Done : Route the DNS Have your agent do it

6. Test, then install as a service

   Run the tunnel by hand to check that everything answers:

   cloudflared tunnel run mini
   

   Open https://myapp.your-domain.com in a browser. If your local app responds, you’ve won. Stop it with Ctrl+C, then install it as a service so it survives reboots:

   # With sudo, ~ means /root: so give the full path to your config
   sudo cloudflared --config /home/your-user/.cloudflared/config.yml service install
   # Start the service and check that it's running
   sudo systemctl start cloudflared
   systemctl status cloudflared
   

   That’s the classic trap: run with sudo but without --config, cloudflared looks for its config in root’s folder and finds nothing. After each change to config.yml, a sudo systemctl restart cloudflared applies it.

   Done Done : Test, then install as a service Have your agent do it