---
title: Cloudflare Tunneling
---

# Cloudflare Tunnel Setup: :simple-icons-cloudflare: :mingcute-tunnel-line:

Sometimes, someone might want to deploy the DP-SALAD stack behind *NAT* or you don't want to open your network's ports exposing them to the outside.

:::tip Note:
You do not need to have your domain registered through Cloudflare :simple-icons-cloudflare: to use Cloudflare Tunnels
:::

## THE SOLUTION?

**Cloudflare Tunnels** :party-popper:

Of course, running the stack this way comes with some extra configuartion on both the Docker side and Cloudflare/domain side.

This is an excerpt from the [One-Click Docker Compose file](/docker-compose.md):

In order to make this work with cloudflare tunneling, you must add some more lines to your docker compose. The first being a directive which is highlighted below:

```yml{21-22}
version: "2.1"
services:
  swag:
    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Phoenix
      - URL=[sakura.nt]
      - VALIDATION=dns
      - SUBDOMAINS=wildcard
      - DNSPLUGIN=cloudflare
      - EMAIL=[sakurant@gmail.com]
      - ONLY_SUBDOMAINS=false
      #- EXTRA_DOMAINS= #optional
      - STAGING=false
      - DOCKER_MODS=linuxserver/mods:universal-docker|linuxserver/mods:swag-auto-reload|linuxserver/mods:swag-dashboard|linuxserver/mods:swag-dbip|linuxserver/mods:universal-cloudflared
    extra_hosts:
        - domain.tld:127.0.0.1
    volumes:
      - /home/[INSERT USER FOLDER HERE]/appdata/swag:/config
    ports:
      - 443:443
      - 80:80
    networks:
      - [INSERT NETWORK NAME HERE]
    restart: unless-stopped
```

Next, you'll want to generate an API key :material-symbols-key-outline: with Cloudflare :simple-icons-cloudflare:, go to *Overview* in your domain, and click "*get your api token*", click *Create Token*, use → "*Edit zone DNS*" template, add a permission, select "*Account*", → "*Cloudflare Tunnel*", → "*Edit*", under account resources, include your account, under zone resources, include your domain. Continue with setup, **make sure you keep track of the API key somewhere**.

After you have completed these steps, you will need to add these credentials to your Swag configuration in the **docker-compose.yml**. After the *Docker_Mods* environment variable, add these lines:

```yml
version: "2.1"
services:
  swag:
    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Phoenix
      - URL=[sakura.nt]
      - VALIDATION=dns
      - SUBDOMAINS=wildcard
      - DNSPLUGIN=cloudflare
      - EMAIL=[sakurant@gmail.com]
      - ONLY_SUBDOMAINS=false
      #- EXTRA_DOMAINS= #optional
      - STAGING=false
      - DOCKER_MODS=linuxserver/mods:universal-docker|linuxserver/mods:swag-auto-reload|linuxserver/mods:swag-dashboard|linuxserver/mods:swag-dbip|linuxserver/mods:universal-cloudflared
      - CF_ZONE_ID=zone id from cloudflare domain overview // [!code focus]
      - CF_ACCOUNT_ID=account id from cloudflare domain overview // [!code focus]
      - CF_API_TOKEN=api token generated // [!code focus]
      - CF_TUNNEL_NAME=create a tunnel, name it whatever // [!code focus]
      - CF_TUNNEL_PASSWORD=generate a long password // [!code focus]
      - FILE__CF_TUNNEL_CONFIG=/config/tunnelconfig.yml // [!code focus]
    extra_hosts:
        - domain.tld:127.0.0.1
    volumes:
      - /home/[INSERT USER FOLDER HERE]/appdata/swag:/config
    ports:
      - 443:443
      - 80:80
    networks:
      - [INSERT NETWORK NAME HERE]
    restart: unless-stopped
```

You're not quite done yet... :cold-face:

You'll need to add more to finish the installation:
First, `nano /home/[USER]/appdata/swag/tunnelconfig.yml`, and add these contents:

```yml
ingress:
  - hostname: domain.tld
    service: https://domain.tld
  - hostname: "*.domain.tld"
    service: https://domain.tld
  - service: http_status:404
```

Then, edit the `/home/[USER]/appdata/swag/dns-conf/cloudflare.ini`, add the API token, you'll comment the top two lines, add the token after uncommenting the bottom line.

:::details *insert funni meeme here:*
![/cat-typing.gif](/cat-typing.gif)
:::