Expose a local server with Cloudflare Tunnel

Exposing your local server to the internet without dealing with port forwarding or static IP addresses is straightforward using Cloudflare Tunnels. This guide walks you through setting up a tunnel via Docker to route traffic to your local infrastructure.

To follow this tutorial you need a local Linux server with Docker installed and your domain managed in Cloudflare.

Authenticate with Cloudflare

First, log in to your Cloudflare account and authorize your domain from your terminal using the command-line interface:

docker run -it --rm --user root -v cloudflared-auth:/root/.cloudflared cloudflare/cloudflared:latest tunnel login

Create the tunnel and DNS record

Next, create a tunnel. Replace <tunnel_name> with any identifier you prefer:

docker run -it --rm --user root -v cloudflared-auth:/root/.cloudflared cloudflare/cloudflared:latest tunnel create <tunnel_name>

This command creates a DNS record automatically, so ensure the record does not already exist in your Cloudflare dashboard:

docker run -it --rm --user root -v cloudflared-auth:/root/.cloudflared cloudflare/cloudflared:latest tunnel route dns <tunnel_name> <domain>

Set up the Docker network and configuration

Create the shared external network that connects the tunnel to your applications:

docker network create ingress

mkdir -p /srv/core-and-shared/cloudflared/
cd /srv/core-and-shared/cloudflared/

Define the Docker Compose service for the tunnel by creating /srv/core-and-shared/cloudflared/compose.yaml with the following configuration:

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token ${TUNNEL_TOKEN} --url http://whoami:80
    networks:
      - ingress

networks:
  ingress:
    name: ingress
    external: true

To get your tunnel token, run this command to query your account details:

docker run -it --rm --user root -v cloudflared-auth:/root/.cloudflared cloudflare/cloudflared:latest tunnel token <tunnel_name>

Create a .env file at /srv/core-and-shared/cloudflared/.env to store your token:

TUNNEL_TOKEN=<tunnel_token>

Run and test the tunnel

Start the Cloudflare tunnel in the background using Docker Compose:

docker compose up -d

To test the setup, you can spin up a temporary container to verify routing:

docker run --rm -d --name whoami --network ingress traefik/whoami

curl https://<domain>

When you are done testing, stop the temporary container and it will be removed automatically:

docker stop whoami

Use Caddy as a reverse proxy on a local server

Learn how to configure Caddy as a local reverse proxy using Docker and Docker Compose, complete with automatic routing and Cloudflare Tunnel integration.