Cloudflare Tunnels

[gawhite]

Are there any guides on utilizing cloudflare tunnels to a server inside my network? I would prefer to utilize that method with my cloudflare certificate.

[nktnet1]

I got it working with cloudflare tunnels (both regular and wildcard subdomains) on my home server.

Often times there are resources for Coolify that are transferable - examples here:

• https://coolify.io/docs/knowledge-base/cloudflare/tunnels/
• Cloudflare Tunnel doesn't work with wildcards coollabsio/coolify#2926 (comment)

Some pointers:

1. Run "cloudflared" service as a raw compose service in Dokploy:

   services:
     cloudflared:
       container_name: cloudflare-tunnel
       image: 'cloudflare/cloudflared:latest'
       restart: unless-stopped
       command: 'tunnel --no-autoupdate run'
       environment:
         - 'TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}'   # don't forget to set this in Dokploy Environment
       network_mode: host

2. Make sure everything is HTTP instead of HTTPS on Dokploy (don't use "let's encrypt", etc). For example, http://dokploy.example.com. Cloudflare will automatically convert it to HTTPS (you may also want to turn off HTTP access in cloudflare settings altogether).

3. Make sure that your cloudflare domain's SSL/TLS is set to Full or Full (Strict)

[Codder13]

Have you succeeded in setting it up ?

[lwndp]

Hi @nktnet1 !
Thanks for the pointers.
Did you manage to override dokploy's open ports? Since we can't trivially change the dokploy compose file, and due to docker networking privileges, I'm concerned about remaining open ports after your suggested setup.
Would appreciate your thoughts on this, even if my question is stupid :)

[djsisson]

@lwndp you can just run

docker service update --publish-rm 3000 dokploy

[lwndp]

@djsisson ty!
I've made the following observations:

• Tunnels need public hostnames for each individual app, all pointing to traefik. It's not enough to create one "tunnel hostname" and cname all app's domains to it (I did not know that before)
• To access dokploy dashboard via tunnels, I needed to add dokploy:3000 directly instead of dokploy-traefik:80 as the hostname's service and add 1) a router with this domain to the dokploy.yml traefik dynamic config and 2) override ALLOWED_ORIGINS env variable in the dokploy container with https://localhost:3000, https://sub.mydomain.com

The latter is still not entirely clear to me, since I should be able to attach this hostname to the traefik container as well and still reach the dashboard, no?
At least that should be the case in a normal install, am I right? I reach my host via 443 on the hostname defined in my dokploy.yml and get routed to the dashboard by traefik.

Would be great if someone could clarify this aspect as my mind is a bit stuck at this point.

My end goal is to leave no open ports on the server for HTTP traffic and tunnel everything. My finding above suggests removing port 3000 from dokploy would break the tunnel, but not removing it would keep it open on my host (docker overrides firewall rules).

[nktnet1]

Tunnels need public hostnames for each individual app, all pointing to traefik

You can use a wildcard subdomain.

To access dokploy dashboard via tunnels, I needed to add...

I don't know what your exact setup is, but I'm pretty sure you're over complicating it.
The wildcard subdomain alone allowed me access to Dokploy via Traefik, as well as everything else.

It was a "setup once and forget".

I don't have the time to help and debug or further explain it, but I wrote a bit more about it on the PR - hope you can set it up in the way you wanted.

• feat(template): added cloudflared #1104 (comment)

---

As for concerns about "open ports", not sure if you're referring to just used ports on your host machine that are not exposed to the public, or actual, publicly available ports that anyone can access on the internet.

If the latter, I'm sure your VPS (or router) can be configured to block all ports - e.g. on Hetzner, Firewall can be configured through the UI.

If the former, only 80/443 are used on host, if you really don't want to take up port 3000.

[djsisson]

@lwndp your first point is not true, you can just use a wildcard

not sure why your setup isnt working. make sure you dont mix http and https, e.g if dokploy is using a https host with a http-https redirect, and you run http tunnel, it wont work

usually i do the following:

create one network with just cloudflared and traefik in it, do not run either in host mode
then in tunnels just create 2 entries per apex domain of wildcard pointing to traefik:443 (traefik is the service name you are using)
(note i use 443, and set origin domain in tls settings per tunnel entry this means i can still get tls passthrough to containers when needed)

thats it, then for external loadbalancing, you can just run the same tunnel id elsewhere, cloudflare would automatically, pick the nearest tunnel to the request.

you can then remove all port bindings, other than ssh (which you can manage)

as a last step, you turn on split tunnels and select your lan ip subnet, then anywhere locally, you can run cf warp with that subnet as virtual network, meaning your servers are now accessible locally without needing to use any kind of ssh tunnel.

[lwndp]

Got it figured out @djsisson @nktnet1 . Thanks so much for your help!

The key issue was my assumption that I'd be able to declare a subdomain for my tunnel and cname all service domains to it. That's not possible. I'd have to be a wildcard of the root domain that an app subdomain is from. Then it works perfectly fine.
Paired with a DNS acme certificate resolver it's a solid, no ports open setup for me :)

[woodchen-ink]

I create a compose like:

networks:
    dokploy-network:
        external: true
services:
  cloudflared:
    image: 'cloudflare/cloudflared:latest'
    environment:
      - TUNNEL_TOKEN=eyJhIjoiZmVlZGxxxxxxx
    networks:
      - dokploy-network
    restart: unless-stopped
    command: [
      "tunnel",

      # More tunnel run parameters here:
      # https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-run-parameters/
      "--no-autoupdate",
      #"--protocol", "http2",

      "run"
    ]

With this setup, I can proxy a service through Cloudflared without exposing any ports on the host.
Since both containers are attached to the same Docker network (dokploy-network), they can communicate directly without requiring port mapping.

[njxqlus]

I've also ended with setup similar to @woodchen-ink

services:
  app:
    image: crccheck/hello-world
    networks:
      - int
    
  tunnel:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
    command:
      - tunnel
      - --no-autoupdate
      - run
    depends_on: 
      - app
    networks: 
      - int

networks:
  int:
    driver: overlay
    attachable: true

Cloudflare points to http://app:8000