Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

61–70 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#61

Post by amluto »

jgrahamc wrote: post #37
amluto wrote: post #35

If only there was a straightforward way to manage the credentials used by cloudflared for tunnels, bind them to specific websites, and revoke them. In principle, there is no reason at all to use TLS inside the tunnel — the tunnel itself is authenticated and encrypted. Unfortunately, cloudflare tunnels feel a bit like a cute 20% project that was never quite finished and is barely integrated with the rest of cloudflare…

Feel free to email me jgc@cloudflare with complaints, ideas, etc. The team that works on Tunnel just pinged me with the internal ticket where they are working on the management UI you are looking for. So... soon!

Will do!

Re: Exposing a web service with Cloudflare Tunnel

#62

Post by sascha_sl »

reilly3000 wrote: post #25

I just set up a Cloudflare Tunnel this weekend to my homelab. I was able to connect it up with a container within minutes. I also was able to set up their zero trust offering and had route based RBAC against two domains w/ Google OAuth2 login. I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic and saved me quite a bit of trouble with messing with my RouterOs conf…

It's unfortunate the only mature open source alternative[1] went on a path to seriously expensive subscriptions, 5x of a tailscale personal subscription.

[1]: https://inlets.dev/

Re: Exposing a web service with Cloudflare Tunnel

#63

Post by sascha_sl »

napkin wrote: post #15

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives…

The real beauty of cloudflared is that you can just throw it into a sidecar for your k8s pod / docker-compose container set and configure the entire thing in one place.

Re: Exposing a web service with Cloudflare Tunnel

#64

Post by anderspitman »

sascha_sl wrote: post #62
reilly3000 wrote: post #25

I just set up a Cloudflare Tunnel this weekend to my homelab. I was able to connect it up with a container within minutes. I also was able to set up their zero trust offering and had route based RBAC against two domains w/ Google OAuth2 login. I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic and saved me quite a bit of trouble with messing with my RouterOs conf…

It's unfortunate the only mature open source alternative[1] went on a path to seriously expensive subscriptions, 5x of a tailscale personal subscription. [1]: https://inlets.dev/

There are lots of other open source options[0]. Whether you would consider any mature is a bit more subjective.

[0]: https://github.com/anderspitman/awesome-tunneling

Re: Exposing a web service with Cloudflare Tunnel

#65

Post by cestith »

warp wrote: post #19
chrisweekly wrote: post #2

This looks pretty interesting to me. Self-hosting a webapp origin server on hardware in my house, fronted by CloudFlare... hmm. Food for thought.

One of the limitations that wasn't immediately obvious to me is that you're mapping a single domain with these tunnels. So you cannot easily make *.example.com available via a cloudflare tunnel. (and when I tried it it wasn't possible with ngrok either, perhaps that changed) I ended up switching to a business connection with my ISP, so I could get an extra fixed IPv4 address at my house and not need any of these tunn…

The ingress example with multiple subdomains and a default service seem to suggest one can host more than one subdomain. It would require setting your tunnel DNS on the Cloudflare side to point all of them to the tunnel.

Re: Exposing a web service with Cloudflare Tunnel

#66

Post by api »

hombre_fatal wrote: post #58
api wrote: post #42

Earlier quoted context omitted.

> I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic Superior UI/UX offered by centralized systems is why everything is being centralized. People will trade everything including privacy and security for ease of use. The market has shown this time and time again.

Getting ddosed by a $5 botnet, which gets cheaper every day, tends to change people's minds about Cloudflare. Your users don't really care about decentralized utopia when your service doesn't work.

The only decentralization that's going to work is actual decentralization where there's not really anything to DDOS, or rather the entire system is itself a botnet.

Re: Exposing a web service with Cloudflare Tunnel

#67

Post by gtsteve »

napkin wrote: post #15

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives…

I recently used the same Cloudflare Tunnel project to put an internal hosted service behind Cloudflare access.

I chose this over Wireguard because it integrates with our SSO system and users don't have to configure a firewall client. In fact, most users don't know we even did anything special to secure the service.

Secondly, I can set up wireguard, but then I would be responsible for maintenance, keeping the instance up and patched etc. You may save money by using Wireguard, but you pay for it in time, which is the only thing you cannot buy.

Re: Exposing a web service with Cloudflare Tunnel

#68

Post by anderspitman »

api wrote: post #42
reilly3000 wrote: post #25

I just set up a Cloudflare Tunnel this weekend to my homelab. I was able to connect it up with a container within minutes. I also was able to set up their zero trust offering and had route based RBAC against two domains w/ Google OAuth2 login. I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic and saved me quite a bit of trouble with messing with my RouterOs conf…

> I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic Superior UI/UX offered by centralized systems is why everything is being centralized. People will trade everything including privacy and security for ease of use. The market has shown this time and time again.

Not to mention Cloudflare Tunnel is a loss leader. Basically any new entrant has to either get funding or justify charging money for tunnel traffic.

Cloudflare Tunnel has gotten good enough there aren't a lot of ways to be better left. A couple would be offering e2ee and a less stringent ToS (technically anything other than normal HTML websites is not permitted, though I'm not aware of this ever being enforced, yet).

Re: Exposing a web service with Cloudflare Tunnel

#69

Post by inconshreveable »

kordlessagain wrote: post #8

I would rather use ngrok for these things: https://ngrok.com/ The reason why is because Alan is awesome.

Thanks Kord! Founder of ngrok here, just a quick note of correction for others in this thread: ngrok is absolutely intended for production use cases. There are many customers both hobbyist and enterprise running thousands of production workloads over ngrok's service (including ourselves! we dogfood ngrok for our ingress). We're excited to be sharing more about that with the HN community really soon.

Re: Exposing a web service with Cloudflare Tunnel

#70

Post by caseysoftware »

warp wrote: post #19
chrisweekly wrote: post #2

This looks pretty interesting to me. Self-hosting a webapp origin server on hardware in my house, fronted by CloudFlare... hmm. Food for thought.

One of the limitations that wasn't immediately obvious to me is that you're mapping a single domain with these tunnels. So you cannot easily make *.example.com available via a cloudflare tunnel. (and when I tried it it wasn't possible with ngrok either, perhaps that changed) I ended up switching to a business connection with my ISP, so I could get an extra fixed IPv4 address at my house and not need any of these tunn…

Yes, we made it easier a while back. Now you can map customname.ngrok.io to your tunnel with a command line switch. If you want to use a CNAME, it's a similar switch, a dashboard entry, and an update to your DNS entries. I did it on my own domain in a couple minutes, flushed the DNS records, and had it routable in ~15 minutes. The full docs are here: https://ngrok.com/docs#http-custom-domains

Disclosure: I work at ngrok

Post reply on HN