Exposing a web service with Cloudflare Tunnel • Hacker News Board

Re: Exposing a web service with Cloudflare Tunnel

#101

Post by rank0 » Tue, Feb 08, 2022, 5:17 PM UTC

superkuh wrote: post #96

rank0 wrote: post #89

Earlier quoted context omitted.

Well their WAF and dos protection are pretty nice. An easy secure setup would be to spin up a guest VM and isolate it in its own subnet. Disable routing between your guest and the rest of your lan and you can sleep easy at night so long as your app doesn’t serve any crazy dynamic content.

"Walking around covered in body armor and allowing the military to drive me to work in a tank" is nice protection but it's also very restrictive. I don't think the argument against this is so much that Cloudflare doesn't provide nice features as that those features are entirely unneeded for 99.99% of people hosting from home. The downsides of heavy protection are vastly increased complexity and dependence on a non-'d…

Lmao your response made me chuckle. You're entirely right! Probably nothing bad will happen. Especially if you partition your network like I mentioned in my OP.

I would get worried about somehow enabling access to defects in my router by opening some inbound ports. I realize that's a little paranoid...but recently I have been playing around with https://github.com/threat9/routersploit and routinely find defects in consumer routers.

Here's my other beef with cloudflare: Once I gotta pay 200+/mo for their security services or whatever, I could just rent out a private rack in a colocation and throw some old beefy lga-2011 xeon hosts. Now I don't need anything on my LAN exposed and I have dedicated IPs, physical security, and backup generators...etc.

Re: Exposing a web service with Cloudflare Tunnel

#102

Post by freediver » Tue, Feb 08, 2022, 5:17 PM UTC

anderspitman wrote: post #94

freediver wrote: post #92

Earlier quoted context omitted.

If I wanted my grandma to host a folder from her Mac so I can access it from the web, what solution feels best?

What's the goal? Does your grandma want to start a blog and you're talking about hosting the HTML from that folder, or do you want to be able to access the folder to read/write files, or something else?

The goal is to host a html page and/or share a file.

Re: Exposing a web service with Cloudflare Tunnel

#103

Post by skrebbel » Tue, Feb 08, 2022, 5:27 PM UTC

A word of warning wrt hard-relying your service on Cloudflare. They have hidden undocumented limits. When we hit those, they dropped ~10% of our traffic without warning and they did not respond to our support requests with anything other than platitudes, despite us being on their business plan. After ghosting us for 2 weeks they tried to upsell us to the Enterprise plan for more leeway on said undocumented limits (all the while not providing any insights as to what limits we were hitting, nor how).

I don't think they were malicious, I suspect growing pains, but it very much didn't match their stellar reputation.

After that experience we made sure not to rely on them for anything that we couldn't instantly turn off or switch away from. I'd run a blog behind cloudflare without worries but not sure anymore about nontrivial high-traffic applications.

Re: Exposing a web service with Cloudflare Tunnel

#104

Post by babagabooj » Tue, Feb 08, 2022, 5:29 PM UTC

apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

What about Slack's Nebula? Tailscale is not fully open source. I believe there is also headscale which is attempting to replace the closed-source parts of Tailscale. But I am curious about Slack's Nebula. Has anyone used it for anything like this?

Re: Exposing a web service with Cloudflare Tunnel

#105

Post by jgrahamc » Tue, Feb 08, 2022, 5:33 PM UTC

skrebbel wrote: post #103

A word of warning wrt hard-relying your service on Cloudflare. They have hidden undocumented limits. When we hit those, they dropped ~10% of our traffic without warning and they did not respond to our support requests with anything other than platitudes, despite us being on their business plan. After ghosting us for 2 weeks they tried to upsell us to the Enterprise plan for more leeway on said undocumented limits (al…

The sounds weird. Please email me (jgc@cloudflare) and tell me what happened.

Re: Exposing a web service with Cloudflare Tunnel

#106

Post by anderspitman » Tue, Feb 08, 2022, 5:34 PM UTC

freediver wrote: post #102

anderspitman wrote: post #94

Earlier quoted context omitted.

What's the goal? Does your grandma want to start a blog and you're talking about hosting the HTML from that folder, or do you want to be able to access the folder to read/write files, or something else?

The goal is to host a html page and/or share a file.

I'm not aware of a good solution to this currently, but it's a space I'm very interested in. The main problem is that the devices most people use these days (phones and laptops) are constantly being connected and disconnected from networks. So even if you solve the software problem and make a nice GUI program for your grandma to use which automatically handles TLS certs and tunneling, if she closes her laptop her blog goes down.

I think the way to do this may be to ship services as Android apps. Imagine something like self-hosted Google Drive that you install as an app on an old Android phone. After install you go through a quick OAuth2 flow to connect it to a subdomain and open a tunnel, and now you have 64-128GB of e2ee cloud storage. Just plug the phone in and leave it in a corner.

This concept can be applied to Nextcloud, Jellyfin, Plex, your grandma's blog, etc.

Re: Exposing a web service with Cloudflare Tunnel

#107

Post by stavros » Tue, Feb 08, 2022, 5:39 PM UTC

jgrahamc wrote: post #105

skrebbel wrote: post #103

A word of warning wrt hard-relying your service on Cloudflare. They have hidden undocumented limits. When we hit those, they dropped ~10% of our traffic without warning and they did not respond to our support requests with anything other than platitudes, despite us being on their business plan. After ghosting us for 2 weeks they tried to upsell us to the Enterprise plan for more leeway on said undocumented limits (al…

The sounds weird. Please email me (jgc@cloudflare) and tell me what happened.

I come to HN for the articles, but I stay for the customer support.

Re: Exposing a web service with Cloudflare Tunnel

#108

Post by stavros » Tue, Feb 08, 2022, 5:42 PM UTC

I do this for our services, it works great and we can easily put SSO in front of them with CF Access. I publish a Docker container that you can use as a sidecar for your Compose deployments:

https://gitlab.com/stavros/docker-cloudflared

I use this with Harbormaster (https://gitlab.com/stavros/harbormaster) so I can expose containerized stuff without ever forwarding any ports outside of Docker.

Re: Exposing a web service with Cloudflare Tunnel

#109

Post by freediver » Tue, Feb 08, 2022, 6:00 PM UTC

anderspitman wrote: post #106

freediver wrote: post #102

Earlier quoted context omitted.

The goal is to host a html page and/or share a file.

I'm not aware of a good solution to this currently, but it's a space I'm very interested in. The main problem is that the devices most people use these days (phones and laptops) are constantly being connected and disconnected from networks. So even if you solve the software problem and make a nice GUI program for your grandma to use which automatically handles TLS certs and tunneling, if she closes her laptop her blo…

If persistence is not key, what is the easiest way to do this? Like if I am on a phone with grandma and want to see a local HTML page from her Mac, what do my simplest instructions for her look like?

Re: Exposing a web service with Cloudflare Tunnel

#110

Post by anderspitman » Tue, Feb 08, 2022, 6:03 PM UTC

lappet wrote: post #99

A little off topic, but does anyone know the best way to run software on an unused Android phone? For some reason this seems harder than it used to be. My goal is to run Home assistant on it, and I am struggling with issues on Termux right now. There must be a better way.

Good luck, it's a hot mess. I spent considerable time last year porting boringproxy to run on Android. There are countless hoops to jump through for running server software, including:

* You have to run it as a foreground service so the user knows it's running. Not a problem in theory but annoying to implement.

* DNS name resolution doesn't work by default (with Golang at least) because android doesn't use resolve.conf. I solved this by setting DNS servers manually to 1.1.1.1, 8.8.8.8, etc.

* You have to do weird hacks in order to run native applications such as Golang programs.

* Android has endless optimizations for battery life that are trying to shut down/throttle your program. One example I would see huge performance differences as soon as I turned the screen off.

Overall I consider Android to be a very hostile environment for native applications, and networked apps in particular. iOS is even worse from what I can tell. We need a mobile OS that respects the user's control over their device. I'm fine with sane defaults, but it should be easy to switch them off. I'm hopeful for the Pinephone, but we have a long way to go.