Cloudflare tunnel support

[bgervan]

Is there any plan supporting cloudflare tunnels (cloudflared) to expost web apps?

[scart88]

I'm using Caddy as a load balancer to reverse proxy into private VMs.

You could use cloudflared to achieve that as well...

[imWildCat]

Could you share a code snippets?

[jeremy]

No plans for native support.

You can experiment with deploying cloudflared as a Kamal accessory, though, and having it target an alternate Traefik entrypoint.

Odds are good you can wire it up without additional support from Kamal.

[imWildCat]

Thanks @jeremy !

I'm sharing my config:

accessories:
  cloudflared:
    image: cloudflare/cloudflared:2024.6.0
    host: 192.168.3.80
    port: 10801
    env:
      secret:
        - TUNNEL_TOKEN
    cmd: tunnel run
# Configure custom arguments for Traefik. Be sure to reboot traefik when you modify it.
traefik:
  host_port: 18081
  args:
    accesslog: true

it works perfectly.

[ngtrieuvi92]

thanks @imWildCat, thank for your sharing, that's work perfectly.
In my configuration, I just add and external docker network for cloudflared, app and traefik, then in tunnel config, I can point domain directly into http://traefik:80

accessories:
  cloudflared:
    image: cloudflare/cloudflared:2024.6.0
    host: 136.20.33.21
    env:
      secret:
        - TUNNEL_TOKEN
    cmd: tunnel run
    options:
      network: "pff"

# Configure custom arguments for Traefik
traefik:
  options:
    network: "pff"
  args:
    accesslog: true
    entryPoints.web.address: ":80"
  labels:
    traefik.enable: true

I also wrap up it into a short post https://vinguyen.blog/secure-website-hosting-without-open-ports-cloudflare-tunnel-and-kamal-deploy/

[imWildCat]

awesome! thanks for the writing!

[scomma]

I struggled for a couple hours trying to get @imWildCat's solution to work with Kamal 2, which uses kamal-proxy in lieu of traefik. Turns out the cloudflared accessory runs in a special network where it can't directly connect to the host machine's port 80.

To solve this, inside Cloudflare website's tunnel configuration, set the target to kamal-proxy's container directly.