Cloudflare Tunnels

Cloudflare Tunnels provide a secure way to expose NodeKAT to the internet without configuring firewall rules or opening ports on your server.

Why Cloudflare Tunnels?

No Port Forwarding

Expose services without opening firewall ports or configuring NAT.

Automatic SSL

Free SSL certificates automatically managed by Cloudflare.

DDoS Protection

Built-in DDoS protection and rate limiting.

Zero Trust

Integrate with Cloudflare Access for identity-based security.

Prerequisites

A Cloudflare account (free tier works)
A domain managed by Cloudflare
NodeKAT running locally or in Docker
cloudflared installed on your server

Installation

Step 1: Install cloudflared

macOS:

brew install cloudflared

Linux:

# Debian/Ubuntu
wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared-linux-amd64.deb

# Or use the official install script
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

Docker:

docker pull cloudflare/cloudflared

Step 2: Authenticate

cloudflared tunnel login

This will open a browser window to authenticate with Cloudflare. After authentication, you’ll receive a certificate file.

Step 3: Create a Tunnel

cloudflared tunnel create nodekat

This creates a tunnel and outputs a tunnel ID. Save this ID for later use.

Step 4: Configure DNS

Route your domain to the tunnel:

cloudflared tunnel route dns nodekat nodekat.yourdomain.com

Step 5: Create Configuration File

Create ~/.cloudflared/config.yml:

tunnel: <your-tunnel-id>
credentials-file: /root/.cloudflared/<your-tunnel-id>.json

ingress:
  - hostname: nodekat.yourdomain.com
    service: http://localhost:8080
    originRequest:
      noTLSVerify: true
  - service: http_status:404

Step 6: Run the Tunnel

Manual start:

cloudflared tunnel run nodekat

As a service (systemd):

Create /etc/systemd/system/cloudflared.service:

[Unit]
Description=Cloudflare Tunnel for NodeKAT
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/bin/cloudflared tunnel --config /root/.cloudflared/config.yml run
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

Enable and start:

sudo systemctl enable cloudflared
sudo systemctl start cloudflared

Docker Compose Integration

Add cloudflared as a service in your docker-compose.yml:

version: '3.8'
services:
  nodekat:
    # ... your nodekat configuration
    networks:
      - nodekat-network

  cloudflared:
    image: cloudflare/cloudflared:latest
    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN}
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
    depends_on:
      - nodekat
    networks:
      - nodekat-network
    restart: unless-stopped

networks:
  nodekat-network:
    driver: bridge

Get your tunnel token from the Cloudflare dashboard:

Go to Zero Trust → Networks → Tunnels
Click your tunnel
Click Configure under the Connector tab
Copy the token

Advanced Configuration

Multiple Services

Route multiple services through one tunnel:

ingress:
  - hostname: nodekat.yourdomain.com
    service: http://localhost:8080
  - hostname: api.yourdomain.com
    service: http://localhost:3000
  - hostname: admin.yourdomain.com
    service: http://localhost:8081
  - service: http_status:404

Load Balancing

Configure multiple origins for high availability:

ingress:
  - hostname: nodekat.yourdomain.com
    service: http://localhost:8080
    originRequest:
      pool: nodekat-pool

TCP Tunneling

For non-HTTP services:

ingress:
  - hostname: ssh.yourdomain.com
    service: tcp://localhost:22
    originRequest:
      proxyType: ""

Security Best Practices

Enable Cloudflare Access

Protect your tunnel with identity-based access:

Go to Zero Trust → Access → Applications
Click Add an application
Select Self-hosted
Enter your domain: nodekat.yourdomain.com
Configure authentication policies

See our Access Policies guide for detailed instructions.

Restrict Origin IP

Limit which IPs can access your origin:

ingress:
  - hostname: nodekat.yourdomain.com
    service: http://localhost:8080
    originRequest:
      ipRules:
        - allow: false
          ip: 0.0.0.0/0
        - allow: true
          ip: 172.16.0.0/12  # Docker internal

Enable Logging

logfile: /var/log/cloudflared.log
loglevel: info

Monitoring Your Tunnel

Check Tunnel Status

cloudflared tunnel info nodekat

View Logs

# systemd journal
sudo journalctl -u cloudflared -f

# Docker logs
docker-compose logs -f cloudflared

Metrics

Enable Prometheus metrics:

metrics: 0.0.0.0:8081

Troubleshooting

Tunnel Not Connecting

Verify your tunnel token is correct
Check firewall rules (outbound HTTPS required)
Review cloudflared logs

SSL Errors

If you see certificate errors, add to your ingress config:

originRequest:
  noTLSVerify: true

Slow Performance

Enable HTTP/2 and compression:

ingress:
  - hostname: nodekat.yourdomain.com
    service: http://localhost:8080
    originRequest:
      http2Origin: true
      compress: true