Cloudflared - Revision history

Phobos: clarified steps 3

2026-05-31T05:23:57Z

clarified steps 3

← Older revision		Revision as of 05:23, 31 May 2026
Line 11:		Line 11:
	$ nix-shell -p cloudflared		$ nix-shell -p cloudflared
	</syntaxhighlight>You will need to log in to your Cloudflare account through the command line, the following command will open a web browser to allow you to log in:<syntaxhighlight lang="console">		</syntaxhighlight>You will need to log in to your Cloudflare account through the command line, the following command will open a web browser to allow you to log in:<syntaxhighlight lang="console">
	$ cloudflared -- tunnel login		$ cloudflared tunnel login
	</syntaxhighlight>You can use the link it provides on any machine that has a browser in order to get the needed cert.pem file.		</syntaxhighlight>You can use the link it provides on any machine that has a browser in order to get the needed cert.pem file.

Line 43:		Line 43:
	"00000000-0000-0000-0000-000000000000" = {		"00000000-0000-0000-0000-000000000000" = {
	credentialsFile = "${config.sops.secrets.cloudflared-creds.path}";		credentialsFile = "${config.sops.secrets.cloudflared-creds.path}";
	~~default = "http_status:404";~~
	};		};
	};		};
Line 49:		Line 48:
	}\|name=cloudflare_tunnel.nix\|lang=nix}}		}\|name=cloudflare_tunnel.nix\|lang=nix}}
	You can now use the Cloudflare dashboard to add your public hosts.		You can now use the Cloudflare dashboard to add your public hosts.

			==== Declarative igress ====


	However, if you would instead like to do so in your configuration file you may specify ingress rules in your configuration file.{{File\|3={		However, if you would instead like to do so in your configuration file you may specify ingress rules in your configuration file.{{File\|3={
Line 84:		Line 86:
	};		};
	};		};
	}\|name=cloudflare_tunnel.nix\|lang=nix}}		}\|name=cloudflare_tunnel.nix\|lang=nix}}Finally, create a CNAME record with the following command.<syntaxhighlight lang="console">
			$ cloudflared tunnel route dns <your-tunnel> <your-public-domain>
			</syntaxhighlight>

	== Troubleshooting ==		== Troubleshooting ==

Phobos: updated steps for consistency

2026-05-31T05:11:04Z

updated steps for consistency

← Older revision		Revision as of 05:11, 31 May 2026
Line 48:		Line 48:
	};		};
	}\|name=cloudflare_tunnel.nix\|lang=nix}}		}\|name=cloudflare_tunnel.nix\|lang=nix}}
	~~Then you~~ can use the dashboard to add your public hosts ~~(will need to convert the new tunnel to dashboard-managed)~~.		You can now use the Cloudflare dashboard to add your public hosts.

	~~Alternatively~~, ~~save the <code>cert.pem</code>~~ to ~~cloudflared user's %home%/.cloudflared/cert.pem, and instead of using dashboard~~ specify ingress rules in your configuration.nix ~~like this:~~		However, if you would instead like to do so in your configuration file you may specify ingress rules in your configuration file.{{File\|3={
			inputs,
			config,
			...
			}: {

			imports = [
			inputs.sops-nix.nixosModules.sops
			];

			sops = {
			age.keyFile = "/home/username/.config/sops/age/keys.txt";
			defaultSopsFile = secrets/secrets.yaml;

			secrets."cloudflared-creds" = {
			owner = "username";
			group = "users";
			mode = "0400";
			};
			};

	~~<syntaxhighlight lang="nix">~~
	{
	services.cloudflared = {		services.cloudflared = {
	enable = true;		enable = true;
Line 60:		Line 77:
	credentialsFile = "${config.sops.secrets.cloudflared-creds.path}";		credentialsFile = "${config.sops.secrets.cloudflared-creds.path}";
	ingress = {		ingress = {
	"*.domain1.com" = {		"your-registered-domain.com" = "http://localhost:PORT";
	~~service = "http://localhost:80";~~
	~~path = "/*.(jpg\|png\|css\|js)";~~
	};
	~~"*.domain2~~.com" = "http://localhost:80";
	};		};

	default = "http_status:404";		default = "http_status:404";
	};		};
	};		};
	};		};
	}		}\|name=cloudflare_tunnel.nix\|lang=nix}}
	~~</syntaxhighlight>~~

	== Troubleshooting ==		== Troubleshooting ==

Phobos: clarified steps

2026-05-31T04:41:32Z

clarified steps

← Older revision		Revision as of 04:41, 31 May 2026
Line 1:		Line 1:
	[https://github.com/cloudflare/cloudflared Cloudflared] is a command line client ~~for~~ a network tunnel from the ~~cloudflare~~ network to a server.		[https://github.com/cloudflare/cloudflared Cloudflared] is a command line client that can be used to establish a network tunnel from the Cloudflare network to a server.

	~~Introduced in https://github.com/NixOS/nixpkgs/pull/171875~~		== Cloudflare Tunnel ==

	== ~~Example~~ ==		=== Prerequisites ===

	~~To get credentialsFile~~ (e.g. ~~tunnel~~-~~ID.json~~) do:		* A Cloudflare account
	<syntaxhighlight lang="sh">		* A domain registered on Cloudflare (see https://developers.cloudflare.com/fundamentals/manage-domains/add-site/)
	cloudflared tunnel login <the~~-token-~~you~~-see-in-dashboard~~>
	cloudflared tunnel create ~~ConvenientTunnelName~~		If you do not wish to install cloudflared you may use a nix-shell to use it for the following steps without adding it to your configuration.<syntaxhighlight lang="console">
	</syntaxhighlight>		$ nix-shell -p cloudflared
			</syntaxhighlight>You will need to log in to your Cloudflare account through the command line, the following command will open a web browser to allow you to log in:<syntaxhighlight lang="console">
			$ cloudflared -- tunnel login
			</syntaxhighlight>You can use the link it provides on any machine that has a browser in order to get the needed cert.pem file.

			Afterwards you will need to create the tunnel from the machine.<syntaxhighlight lang="console">
			$ cloudflared tunnel create <tunnel-name-of-choice>
			</syntaxhighlight>The command will output the tunnel ID in the format 00000000-0000-0000-0000-000000000000, which will be needed for setting up the tunnel service. The following example uses flakes and [https://github.com/Mic92/sops-nix sops-nix] to hide the credentials file secret.
			{{File\|3={
			inputs,
			config,
			...
			}: {

			imports = [
			inputs.sops-nix.nixosModules.sops
			];

			sops = {
			age.keyFile = "/home/username/.config/sops/age/keys.txt";
			defaultSopsFile = secrets/secrets.yaml;

			secrets."cloudflared-creds" = {
			owner = "username";
			group = "users";
			mode = "0400";
			};
			};

	~~<syntaxhighlight lang="nix">~~
	{
	services.cloudflared = {		services.cloudflared = {
	enable = true;		enable = true;
Line 22:		Line 47:
	};		};
	};		};
	}		}\|name=cloudflare_tunnel.nix\|lang=nix}}
			Then you can use the dashboard to add your public hosts (will need to convert the new tunnel to dashboard-managed).
	~~</syntaxhighlight>~~

	Then you can use dashboard to add your public hosts (will need to convert the new tunnel to dashboard-managed).

	Alternatively, save the <code>cert.pem</code> to cloudflared user's %home%/.cloudflared/cert.pem, and instead of using dashboard specify ingress rules in your configuration.nix like this:		Alternatively, save the <code>cert.pem</code> to cloudflared user's %home%/.cloudflared/cert.pem, and instead of using dashboard specify ingress rules in your configuration.nix like this:

Wateir: Remove dublicate [

2025-12-05T19:21:19Z

Remove dublicate [

← Older revision		Revision as of 19:21, 5 December 2025
Line 57:		Line 57:
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	services.openssh.settings.Macs = [		services.openssh.settings.Macs = [
	[
	# Current defaults:		# Current defaults:
	"hmac-sha2-512-etm@openssh.com"		"hmac-sha2-512-etm@openssh.com"

FStefanni: /* Example */

2025-10-15T06:06:27Z

Example

@@ Line 50: / Line 50: @@
+}
 </syntaxhighlight>
 [[Category:Networking]]

Lostmsu: described how to get credentialsFile

2024-09-27T18:56:07Z

described how to get credentialsFile

@@ Line 5: / Line 5: @@
 == Example ==
 <syntaxhighlight lang="nix">
@@ Line 26: / Line 49: @@
    };
+}
 [[Category:Networking]]

Klinger: Category:Networking. Description added, link added

2024-09-26T20:31:17Z

Category:Networking. Description added, link added

← Older revision		Revision as of 20:31, 26 September 2024
Line 1:		Line 1:
			[https://github.com/cloudflare/cloudflared Cloudflared] is a command line client for a network tunnel from the cloudflare network to a server.

	Introduced in https://github.com/NixOS/nixpkgs/pull/171875		Introduced in https://github.com/NixOS/nixpkgs/pull/171875

Line 26:		Line 28:

	</syntaxhighlight>		</syntaxhighlight>
			[[Category:Networking]]

Lostmsu: basic stub with untested config

2024-09-25T20:52:46Z

basic stub with untested config

New page

Introduced in https://github.com/NixOS/nixpkgs/pull/171875

== Example ==

<syntaxhighlight lang="nix">
{
services.cloudflared = {
enable = true;
tunnels = {
"00000000-0000-0000-0000-000000000000" = {
credentialsFile = "${config.sops.secrets.cloudflared-creds.path}";
ingress = {
"*.domain1.com" = {
service = "http://localhost:80";
path = "/*.(jpg|png|css|js)";
};
"*.domain2.com" = "http://localhost:80";
};
default = "http_status:404";
};
};
};
}

</syntaxhighlight>