Apps / System

Cloudflare Tunnel

A way in, without a way in

Holds an outbound connection to Cloudflare and serves your apps over it. Nothing is forwarded on your router and no port is opened — the tunnel dials out, so the box stays invisible from the internet. You pick which hostname maps to which app in the Cloudflare dashboard.

Installing it

Open the dashboard, find it in the App Store and press Install. Or from a terminal on the box:

sudo homebox install tunnel

Good to know

• Create the tunnel at one.dash.cloudflare.com → Networks → Tunnels, then paste its token into Settings. The token IS the credential — anyone holding it can publish through your tunnel
• Point a public hostname at the container name, not the LAN IP: http://vaultwarden:80, http://linkding:9090. cloudflared shares a docker network with them, so it resolves those by name
• Anything you publish this way is reachable by the whole internet. Put Cloudflare Access in front of any app whose own login you would not want brute-forced
• This is what makes Vaultwarden usable: its vault needs HTTPS to decrypt in the browser, and the tunnel gives it a real certificate at the edge

View this app's definition on GitHub