mirror of
https://github.com/prdlk/dotfiles.git
synced 2026-11-03 11:37:36 +00:00
Prad Nukala
6406208b35
- 16 cross-shell utilities converted to sh/bash chezmoi executables: ai c2p cp-appid extract_agents fab gdc gh-sonr-org-migrate ghg-clone ghn gho git-summary launch_omp_livediff_overlay lc-elir mdcp mdp pj (ghg-clone not named ghg: unrelated cargo binary owns that name) - cwd/history helpers stay per-shell: yy c cd clip-last + ghg/ghn/gho cd-wrappers in bash/functions/ and zsh/functions/, loaded by rc files - fish keeps only shell-state functions; converted ones now hit PATH - cp-appid ignore gating moved to .local/bin path - dot_agents/skills: 82 skills materialized from dotstate storage so dot_claude skill symlinks resolve on fresh bootstrap; dotstate profile/symlinks.json released .agents/skills .bashrc .zshrc
3.7 KiB
3.7 KiB
Cloudflare Tunnel
Secure outbound-only connections between infrastructure and Cloudflare's global network.
Overview
Cloudflare Tunnel (formerly Argo Tunnel) enables:
- Outbound-only connections - No inbound ports or firewall changes
- Public hostname routing - Expose local services to internet
- Private network access - Connect internal networks via WARP
- Zero Trust integration - Built-in access policies
Architecture: Tunnel (persistent object) → Replica (cloudflared process) → Origin services
Terminology:
- Tunnel: Named persistent object with UUID
- Replica: Individual
cloudflaredprocess connected to tunnel - Config Source: Where ingress rules stored (local file vs Cloudflare dashboard)
- Connector: Legacy term for replica
Quick Start
Local Config
# Install cloudflared
brew install cloudflared # macOS
# Authenticate
cloudflared tunnel login
# Create tunnel
cloudflared tunnel create my-tunnel
# Route DNS
cloudflared tunnel route dns my-tunnel app.example.com
# Run tunnel
cloudflared tunnel run my-tunnel
Dashboard Config (Recommended)
- Zero Trust > Networks > Tunnels > Create
- Name tunnel, copy token
- Configure routes in dashboard
- Run:
cloudflared tunnel --no-autoupdate run --token <TOKEN>
Decision Tree
Choose config source:
Need centralized config updates?
├─ Yes → Token-based (dashboard config)
└─ No → Local config file
Multiple environments (dev/staging/prod)?
├─ Yes → Local config (version controlled)
└─ No → Either works
Need firewall approval?
└─ See networking.md first
Core Commands
# Tunnel lifecycle
cloudflared tunnel create <name>
cloudflared tunnel list
cloudflared tunnel info <name>
cloudflared tunnel delete <name>
# DNS routing
cloudflared tunnel route dns <tunnel> <hostname>
cloudflared tunnel route list
# Private network
cloudflared tunnel route ip add 10.0.0.0/8 <tunnel>
# Run tunnel
cloudflared tunnel run <name>
Configuration Example
# ~/.cloudflared/config.yml
tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef
credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json
ingress:
- hostname: app.example.com
service: http://localhost:8000
- hostname: api.example.com
service: https://localhost:8443
originRequest:
noTLSVerify: true
- service: http_status:404
Reading Order
New to Cloudflare Tunnel:
- This README (overview, quick start)
- networking.md - Firewall rules, connectivity pre-checks
- configuration.md - Config file options, ingress rules
- patterns.md - Docker, Kubernetes, production deployment
- gotchas.md - Troubleshooting, best practices
Enterprise deployment:
- networking.md - Corporate firewall requirements
- gotchas.md - HA setup, security best practices
- patterns.md - Kubernetes, rolling updates
Programmatic control:
- api.md - REST API, TypeScript SDK
In This Reference
- networking.md - Firewall rules, ports, connectivity pre-checks
- configuration.md - Config file options, ingress rules, TLS settings
- api.md - REST API, TypeScript SDK, token-based tunnels
- patterns.md - Docker, Kubernetes, Terraform, HA, use cases
- gotchas.md - Troubleshooting, limitations, best practices