Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

121–130 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#121

Post by sickill »

sascha_sl wrote: post #63
napkin wrote: post #15

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives…

The real beauty of cloudflared is that you can just throw it into a sidecar for your k8s pod / docker-compose container set and configure the entire thing in one place.

That's a good point, sounds convenient.

Re: Exposing a web service with Cloudflare Tunnel

#122

Post by vngzs »

Quick word of warning: I found it striking that even Cloudflare's Teams product, which supports Tunnels as a feature, does not make Tunnels private (e.g., by enforcing authentication, or restricting who can reach an exposed tunnel to your organization) by default. Anyone on the Internet with the Cloudflare Warp client can reach a Tunnel configured with default settings, a quirk that is not called out in their official documentation.

Re: Exposing a web service with Cloudflare Tunnel

#123

Post by eli »

freediver wrote: post #92
anderspitman wrote: post #86

Earlier quoted context omitted.

In my biased opinion, the "easiest" solution currently is my own boringproxy, which I mention at the top of the list. Once you have the client daemon running on each of your devices (static executable with minimal CLI params and no config file), adding and removing tunnels is just a few clicks in the web UI. It also has basic e2ee. The TLS certs never leave the client devices by default. Even so I agree with you that…

If I wanted my grandma to host a folder from her Mac so I can access it from the web, what solution feels best?

iCloud Drive has file sharing built right into the OS

Re: Exposing a web service with Cloudflare Tunnel

#124

Post by joelbondurant1 »

ErisaDev wrote: post #80
apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

Hi, I'm the author of the blog post being promoted here. I love that list! I also use Tailscale for a lot of my personal private services as well as Cloudflare Tunnel, I think they're both really great :) The concern about Cloudflare decrypting the traffic is valid, I just personally feel for a lot of public websites that's often fine especially if the hoster might have been using Cloudflare already anyway. If an ind…

No post body was provided.

Re: Exposing a web service with Cloudflare Tunnel

#125

Post by moontear »

hombre_fatal wrote: post #58
api wrote: post #42

Earlier quoted context omitted.

> I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic Superior UI/UX offered by centralized systems is why everything is being centralized. People will trade everything including privacy and security for ease of use. The market has shown this time and time again.

Getting ddosed by a $5 botnet, which gets cheaper every day, tends to change people's minds about Cloudflare. Your users don't really care about decentralized utopia when your service doesn't work.

Help me understand what you mean: my service ok particular wouldn’t be ddosed because nobody cares.

I guess bots are hitting CF IPs at large and therefore services might be disrupted?

Re: Exposing a web service with Cloudflare Tunnel

#126

Post by ohyeshedid »

freediver wrote: post #109
anderspitman wrote: post #106

Earlier quoted context omitted.

I'm not aware of a good solution to this currently, but it's a space I'm very interested in. The main problem is that the devices most people use these days (phones and laptops) are constantly being connected and disconnected from networks. So even if you solve the software problem and make a nice GUI program for your grandma to use which automatically handles TLS certs and tunneling, if she closes her laptop her blo…

If persistence is not key, what is the easiest way to do this? Like if I am on a phone with grandma and want to see a local HTML page from her Mac, what do my simplest instructions for her look like?

Out of curiosity, what kind of content are you looking for in that HTML doc?

Re: Exposing a web service with Cloudflare Tunnel

#127

Post by aborsy »

LoveGracePeace wrote: post #113
napkin wrote: post #15

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives…

Similar, I use a cheap AWS Lightsail VPS $3.50 (Lightsail has DDOS protection)-> Wireguard -> Apache Reverse Proxy mod -> my local services.

Why not having clients and local services meet on a Wireguard concentrator on VPs? Thus no need for Apache reverse proxy.

Problem is, 3.5$/month has only 500MB RAM which is very little to run Apache + other services.

Re: Exposing a web service with Cloudflare Tunnel

#128

Post by zachlatta »

ghostly_s wrote: post #112
apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

This isn't required for a shared Plex server, they proxy external connections via their servers automatically.

They limit the bitrate to 4mbps through their relay servers though, which prevents HD streaming.

Re: Exposing a web service with Cloudflare Tunnel

#129

Post by lappet »

anderspitman wrote: post #110
lappet wrote: post #99

A little off topic, but does anyone know the best way to run software on an unused Android phone? For some reason this seems harder than it used to be. My goal is to run Home assistant on it, and I am struggling with issues on Termux right now. There must be a better way.

Good luck, it's a hot mess. I spent considerable time last year porting boringproxy to run on Android. There are countless hoops to jump through for running server software, including: * You have to run it as a foreground service so the user knows it's running. Not a problem in theory but annoying to implement. * DNS name resolution doesn't work by default (with Golang at least) because android doesn't use resolve.co…

sigh, thanks for the response. I think I may move onto RaspberryPi instead. Boringproxy looks like an interesting tool.

Re: Exposing a web service with Cloudflare Tunnel

#130

Post by anderspitman »

lappet wrote: post #129
anderspitman wrote: post #110

Earlier quoted context omitted.

Good luck, it's a hot mess. I spent considerable time last year porting boringproxy to run on Android. There are countless hoops to jump through for running server software, including: * You have to run it as a foreground service so the user knows it's running. Not a problem in theory but annoying to implement. * DNS name resolution doesn't work by default (with Golang at least) because android doesn't use resolve.co…

sigh, thanks for the response. I think I may move onto RaspberryPi instead. Boringproxy looks like an interesting tool.

Honestly for technical users the RPi should be preferred IMO. The reason I want to get Android working is to bring self-hosting to the masses. Turning an old Android phone into a personal cloud by installing a couple apps and putting it in a corner would be huge.

Android is such a pain we might have to settle for shipping custom SD cards for RPi's though.

Post reply on HN