Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

21–30 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#21
post #17

I would rather use ngrok for these things: https://ngrok.com/ The reason why is because Alan is awesome.

out of interest - why? They seem to be targeted at different use cases - ngrok for dev work (looking at pricing and the limits on the free tier), and argo tunnels for permanent services

[deleted]

Re: Exposing a web service with Cloudflare Tunnel

#22
There is no mention of prices on that page, does anyone know how much it costs? Is it included on their free tier, or it is a "free" added service for customers who already pay for other services? If so, I'm curious what would be the cost of the minimum package to get this working.

Re: Exposing a web service with Cloudflare Tunnel

#23
post #18

It's not obvious to me from the blogpost where TLS termination happens in this scenario. I would want it to happen on my local machine, so that (a) Cloudflare can't read my plaintext traffic, and (b) I can manage subdomain certificates more easily via Caddy. Is that possible with the cheapo free tunnels or does Cloudflare want to handle the domain and TLS certificates, too?

You can do both or even no TLS if you want. It's easy to choose so on the domain preferences (it's only per domain, AFAIK)

Re: Exposing a web service with Cloudflare Tunnel

#24

There is no mention of prices on that page, does anyone know how much it costs? Is it included on their free tier, or it is a "free" added service for customers who already pay for other services? If so, I'm curious what would be the cost of the minimum package to get this working.

Available on the free plan at no extra charge https://blog.cloudflare.com/tunnel-for-everyone/

Re: Exposing a web service with Cloudflare Tunnel

#25
I just set up a Cloudflare Tunnel this weekend to my homelab. I was able to connect it up with a container within minutes. I also was able to set up their zero trust offering and had route based RBAC against two domains w/ Google OAuth2 login. I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic and saved me quite a bit of trouble with messing with my RouterOs config and nginx.

Re: Exposing a web service with Cloudflare Tunnel

#26
post #18

It's not obvious to me from the blogpost where TLS termination happens in this scenario. I would want it to happen on my local machine, so that (a) Cloudflare can't read my plaintext traffic, and (b) I can manage subdomain certificates more easily via Caddy. Is that possible with the cheapo free tunnels or does Cloudflare want to handle the domain and TLS certificates, too?

All this changes is how CF connects to the server. Like the rest of CF, outside of using Spectrum Enterprise (which enables TCP 443 tunneling), CF removes TLS at their servers and inspects the traffic so all of its caching/firewall/etc features can be applied. It does add it back when talking to a tunnel, so it’s non plaintext on the wire.

Re: Exposing a web service with Cloudflare Tunnel

#27

I would rather use ngrok for these things: https://ngrok.com/ The reason why is because Alan is awesome.

ngrok is easy to use. Is there any advantage of using Cloudflare Tunnel over ngrok?

ngrok is meant for temporary quick test environments, Cloudflare Tunnel is more of a long-term solution. Although there is https://try.cloudflare.com/ which is designed to be just as quick and easier as ngrok.

Re: Exposing a web service with Cloudflare Tunnel

#30
post #15

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives…

Yep, I've done this with nginx and SSH tunnels, it works well.
Post reply on HN