Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

151–160 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#151

Post by stavros »

ErisaDev wrote: post #149
stavros wrote: post #108

I do this for our services, it works great and we can easily put SSO in front of them with CF Access. I publish a Docker container that you can use as a sidecar for your Compose deployments: https://gitlab.com/stavros/docker-cloudflared I use this with Harbormaster ( https://gitlab.com/stavros/harbormaster ) so I can expose containerized stuff without ever forwarding any ports outside of Docker.

Hi, I'm the author of the blog post being promoted here. I maintain my own Docker image too for personal use ( https://github.com/Erisa/cloudflared-docker ) but I've never ran into a situation where needing everything as an environment variable was required or even desired. I really love the idea of that though, and I love that image!

Yeah, I did it that way because Harbormaster promotes configuration being passed as env vars, so I needed the image to support that. That way, you can deploy cloudflared to a server without touching it beforehand, just by adding the vars to the repo that describes what you want deployed.

Re: Exposing a web service with Cloudflare Tunnel

#152

Post by carride »

ErisaDev wrote: post #88
carride wrote: post #12

Easy to expose ssh server too. Use the .ssh/config ProxyCommand at the client. Cloudflare handles the authentication with the default OTP emailed. They explain towards the end of this tutorial https://developers.cloudflare.com/cloudflare-one/tutorials/s...

Hi, I'm the author of the blog post being promoted here. This is really cool too!! I use Tunnels with SSH a ton. I was considering making a follow-up post going through the SSH setup too, but I felt it was a bit redundant considering that docs page existed. My post was because of the lack of a clear guide for a simple HTTP webserver.

Your tutorial is already more thorough than others. Ideal to help anyone get their HTTP site accessible to the public.

Re: Exposing a web service with Cloudflare Tunnel

#153

Post by ErisaDev »

blinkingled wrote: post #10
davewritescode wrote: post #6

I use this to expose services running in Kubernetes clusters and have Cloudflare tunnel pointing at my Kube gateways. It makes a ton of things like cluster failover much simpler than they otherwise would be.

Could you elaborate on the setup a bit - for cluster fail over do you mean that since cloudflare is your frontend ingress you can easily point it to another cluster or is there more to it?

Not the person replying to (but I am the author of the blog post being promoted here)

I believe they _may_ be referring to the feature of being able to run a single "tunnel" on multiple hosts, using the same credentials and ID. When you do this, not only will Cloudflare automatically serve from the geographically nearest server if it can, but when one client goes offline (When the tunnel is disconnected, not application error sadly) it will automatically ignore that connection and serve from the others, providing some basic degree of failover with no extra payment or much configuration.

I believe you can also easily integrate Tunnels with the paid CF Load Balancer: https://developers.cloudflare.com/cloudflare-one/connections...

Re: Exposing a web service with Cloudflare Tunnel

#154

Post by davewritescode »

blinkingled wrote: post #10
davewritescode wrote: post #6

I use this to expose services running in Kubernetes clusters and have Cloudflare tunnel pointing at my Kube gateways. It makes a ton of things like cluster failover much simpler than they otherwise would be.

Could you elaborate on the setup a bit - for cluster fail over do you mean that since cloudflare is your frontend ingress you can easily point it to another cluster or is there more to it?

We integrate the tunnels with CFs load balancer service which basically lets us route traffic to one or more kubernetes clusters. Right now it’s just for failover where we can repoint a zone from one cluster to another but we’re also looking to route traffic geographically.

One of the great things about cloudflare tunnels is that even without load balancer we can send requests to multiple clusters if we want to.

Makes it really easy to replicate stateless services like ingress gateways.

Re: Exposing a web service with Cloudflare Tunnel

#155

Post by Awmusic12635 »

zachlatta wrote: post #128
ghostly_s wrote: post #112

Earlier quoted context omitted.

This isn't required for a shared Plex server, they proxy external connections via their servers automatically.

They limit the bitrate to 4mbps through their relay servers though, which prevents HD streaming.

The relays only come into effect if the client isn't able to form a direct connection to the server. However most are able to do this without issue and its automatically for the most part.

Re: Exposing a web service with Cloudflare Tunnel

#156

Post by newman314 »

apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

There's also Azure AD Application Proxy [1] and Zscaler Browser Access [2]

No affiliation but what I'm having to use at work.

[1] https://docs.microsoft.com/en-us/azure/active-directory/app-...

[2] https://www.zscaler.com/blogs/company-news/securing-third-pa...

Re: Exposing a web service with Cloudflare Tunnel

#157

Post by watchdogtimer »

ErisaDev wrote: post #147
watchdogtimer wrote: post #115

Is it possible to run a mail server behind a Cloudflare tunnel? Our ISP uses CGNAT, making it impossible to port forward.

Hi, I'm the author of the blog post being promoted here. No, this is not possible. Cloudflare Tunnel focuses mainly on HTTP traffic but also supports SSH, VNC and generic TCP only in situations where the client also uses the cloudflared client to proxy it back to their localhost. Hosting a mail server with these restrictions is not possible I'm afraid.

That's what I thought. Thanks.

Re: Exposing a web service with Cloudflare Tunnel

#158

Post by acdha »

api wrote: post #66
hombre_fatal wrote: post #58

Earlier quoted context omitted.

Getting ddosed by a $5 botnet, which gets cheaper every day, tends to change people's minds about Cloudflare. Your users don't really care about decentralized utopia when your service doesn't work.

The only decentralization that's going to work is actual decentralization where there's not really anything to DDOS, or rather the entire system is itself a botnet.

There’s always something to DDoS. It comes down to whether the attacker has more resources than you have server capacity, and these days attacks can be measured in terabits.

Re: Exposing a web service with Cloudflare Tunnel

#159

Post by devit »

freediver wrote: post #92
anderspitman wrote: post #86

Earlier quoted context omitted.

In my biased opinion, the "easiest" solution currently is my own boringproxy, which I mention at the top of the list. Once you have the client daemon running on each of your devices (static executable with minimal CLI params and no config file), adding and removing tunnels is just a few clicks in the web UI. It also has basic e2ee. The TLS certs never leave the client devices by default. Even so I agree with you that…

If I wanted my grandma to host a folder from her Mac so I can access it from the web, what solution feels best?

An hosting service is the only solution since otherwise the website will be down when the Mac is rebooted or moved if it's a laptop.

The service in this article is either for development purposes or for people who are running dedicated home servers (which means they have a Linux desktop that they keep on 24/7 without rebooting and are usually programmers and/or system administrators).

Re: Exposing a web service with Cloudflare Tunnel

#160

Post by joshuarubin »

anderspitman wrote: post #93
inconshreveable wrote: post #69

Earlier quoted context omitted.

Thanks Kord! Founder of ngrok here, just a quick note of correction for others in this thread: ngrok is absolutely intended for production use cases. There are many customers both hobbyist and enterprise running thousands of production workloads over ngrok's service (including ourselves! we dogfood ngrok for our ingress). We're excited to be sharing more about that with the HN community really soon.

As much as it pains me to say it, Cloudflare seems well positioned to eat ngrok's lunch. AFAIK they offer everything ngrok does plus auto TLS certs, CDN, domain name registration, and tons of other features. They also have way more edge servers for terminating tunnels close to the origin devices. And they can afford to do all this for free as a loss leader product. It's the AWS bundling effect. Oh and the client sour…

ngrok employee here (and lead on our cert system). Re client side auto certs, it's an interesting idea. We do support auto certs, managed within the ngrok cloud. We also support passing through tls termination to the ngrok agent and/or the user's upstream server so that users can use their own certs (which could be obtained programmatically). We also support end-to-end encryption as well as authentication (via mutual tls).

We've got a lot in the works as well.. thoon, real thoon. ;-)

Post reply on HN