Home Linux Stuff

SYS:ONLINE

Zero-Trust Edge Ingress: Deploying Cloudflare Tunnels (cloudflared) for Private Services

Home Linux Staff

2 min read

Opening ports 80 and 443 on your home or office router exposes your public IP address to port scans, DDoS attacks, and zero-day exploit probing.

Modern zero-trust architecture replaces open inbound firewall ports with outbound-only connectors like Cloudflare Tunnels (cloudflared). Your services remain completely invisible to port scanners while being securely accessible to authorized users.

⚡ Quick Runbook: 60-Second Implementation

TL;DR: Copy and deploy the baseline production definition directly onto your host:

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    command: tunnel run
    environment:
      - TUNNEL_TOKEN_FILE=/run/secrets/cf_tunnel_token
    secrets:
      - cf_tunnel_token
    networks:
      - web-tier

networks:
  web-tier:
    external: true

secrets:
  cf_tunnel_token:
    file: ./secrets/cloudflared_token.txt

1. How Outbound-Only Tunnels Work

  1. The cloudflared daemon establishes encrypted, outbound-only QUIC/HTTP2 connections to Cloudflare edge data centers.
  2. No inbound ports are opened on your router or firewall (NAT stays completely closed).
  3. Cloudflare acts as the edge reverse proxy, handling DDoS mitigation, SSL termination, and Cloudflare Access (SSO/MFA) before proxying requests through the tunnel.

2. Production Docker Compose Configuration

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    command: tunnel run
    environment:
      - TUNNEL_TOKEN_FILE=/run/secrets/cf_tunnel_token
    secrets:
      - cf_tunnel_token
    networks:
      - web-tier

networks:
  web-tier:
    external: true

secrets:
  cf_tunnel_token:
    file: ./secrets/cloudflared_token.txt

Related Runbooks in This Series

Tags:

← Previous:
Next: →