Cloudflare Tunnel
Cloudflare Tunnel: a first setup, important settings, verification, and recovery considerations.
Working directory: ~/homelab/core/egress-tunnel. Follow the common setup workflow first. This is a setup note based on the linked documentation, not a copy of my live configuration or a runtime verification of this full stack.
Start here
A tunnel connector makes an outbound connection from your environment to Cloudflare. Begin only after the local routing exercise works. Use a domain you control and a disposable test page. This is an optional publication step; a private lab needs no public tunnel.
Settings and data
Create a tunnel in your own Cloudflare account and follow its current Docker connector instructions. Store its credential outside Git, preferably using a supported file-based option. Map one hostname to one reachable internal HTTP service. Within a connector container, localhost refers to that connector, not your gateway.
Check it
Check connector health, then open the test hostname from an independent internet connection. If the page is meant to be private, create the Access application and allow policy before publishing its route. Test an allowed identity and a signed-out or unauthorized browser.
When something fails
A healthy connector with 502 usually needs origin service, port, DNS, or network checks. An edge DNS error is a different layer. A tunnel does not automatically authenticate visitors or authorize application actions. Protect the connector credential: possession can allow another connector to join. Do not expose the dashboard or private inventory to troubleshoot a single route.