ANSWER-FIRST ARCHITECTURAL SUMMARY

To expose self-hosted homelab services securely, set up an outbound-only Cloudflare Tunnel using `cloudflared` alongside Docker containers. This configuration eliminates the need for inbound port forwarding and protects your origin server from DDoS attacks by utilizing Cloudflare Access for identity management. Key commands include `cloudflared tunnel create` and setting up Docker containers with the appropriate network configurations. This guide details the complete setup process for Debian and Ubuntu systems.

Prerequisites & Environment

Basic knowledge of Docker and container orchestration
Familiarity with Cloudflare services and API
Access to a Debian or Ubuntu server for setup

Securely Expose Homelab Services Using Cloudflare Tunnel and Docker#

Introduction#

Exposing self-hosted services to the public web can be a daunting task, often requiring fragile router port-forwarding and static IP leases. This guide demonstrates how to use Cloudflare Tunnel (cloudflared) in conjunction with Docker to securely expose your homelab services without opening any inbound firewall ports, thereby enhancing security against DDoS attacks and port scanners.

Why Use Cloudflare Tunnel?#

Cloudflare Tunnel provides a secure method to connect your services to the Cloudflare network without exposing your server's IP address. This setup allows for SSL termination and integrates with Cloudflare Access for identity management, ensuring a zero-trust environment.

Prerequisites#

A Debian or Ubuntu server
Docker installed on your server
A Cloudflare account
Basic knowledge of terminal commands

Step 1: Install cloudflared#

To get started, install `cloudflared` on your server. Follow these commands:

BASH

# For Debian/Ubuntu
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared-linux-amd64.deb

Step 2: Authenticate cloudflared#

Run the following command to authenticate `cloudflared` with your Cloudflare account:

BASH

cloudflared tunnel login

This command will open a browser window for you to log in to your Cloudflare account and select the domain you wish to use.

Step 3: Create a Tunnel#

Create a new tunnel with the following command:

BASH

cloudflared tunnel create my-tunnel

This will generate a tunnel ID and a credentials file that will be stored in your home directory.

Step 4: Configure the Tunnel#

Create a configuration file for the tunnel at `~/.cloudflared/config.yml`:

YAML

tunnel: YOUR_TUNNEL_ID
credentials-file: /path/to/your/credentials.json

ingress:
  - hostname: yourservice.example.com
    service: http://localhost:YOUR_SERVICE_PORT
  - service: http_status:404

Replace YOUR_TUNNEL_ID, /path/to/your/credentials.json, yourservice.example.com, and YOUR_SERVICE_PORT with your specific details.

Step 5: Run the Tunnel#

Start the tunnel with the following command:

BASH

cloudflared tunnel run my-tunnel

Step 6: Set Up Docker Containers#

To run your services in Docker, create a `docker-compose.yml` file:

YAML

version: '3'
services:
  myservice:
    image: yourserviceimage
    ports:
      - "YOUR_SERVICE_PORT:YOUR_SERVICE_PORT"

Run your Docker containers:

BASH

docker-compose up -d

Step 7: Configure Cloudflare Access#

To secure your service, set up Cloudflare Access:

Navigate to the Cloudflare dashboard.
Select your domain and go to the Access section.
Create a new application and configure the authentication methods (OAuth/Email PINs).

Conclusion#

By following these steps, you can securely expose your homelab services using Cloudflare Tunnel and Docker without the need for traditional port forwarding. This method not only enhances security but also simplifies access management through Cloudflare Access.

[!NOTE] Ensure that your DNS settings in Cloudflare point to the correct hostname for your tunnel. > [!WARNING] Always monitor your service for unauthorized access attempts and adjust your Cloudflare Access policies accordingly.

Additional Resources#

Written by Alex Carneiro

Founder & Systems Architect at PerMesh. Focused on clean production engineering, automated pipelines, and fast web architectures.