dp-salad-docs/cf-tunnel.md

title
Cloudflare Tunneling

Cloudflare Tunnel Setup: :simple-icons-cloudflare: :mingcute-tunnel-line:

Sometimes, someone might want to deploy the DP-SALAD stack behind NAT or you don't want to open your network's ports exposing them to the outside.

:::tip Note: You do not need to have your domain registered through Cloudflare :simple-icons-cloudflare: to use Cloudflare Tunnels :::

THE SOLUTION?

Cloudflare Tunnels :party-popper:

Of course, running the stack this way comes with some extra configuartion on both the Docker side and Cloudflare/domain side.

This is an excerpt from the One-Click Docker Compose file:

In order to make this work with cloudflare tunneling, you must add some more lines to your docker compose. The first being a directive which is highlighted below:

version: "2.1"
services:
  swag:
    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Phoenix
      - URL=[sakura.nt]
      - VALIDATION=dns
      - SUBDOMAINS=wildcard
      - DNSPLUGIN=cloudflare
      - EMAIL=[sakurant@gmail.com]
      - ONLY_SUBDOMAINS=false
      #- EXTRA_DOMAINS= #optional
      - STAGING=false
      - DOCKER_MODS=linuxserver/mods:universal-docker|linuxserver/mods:swag-auto-reload|linuxserver/mods:swag-dashboard|linuxserver/mods:swag-dbip|linuxserver/mods:universal-cloudflared
    extra_hosts:
        - domain.tld:127.0.0.1
    volumes:
      - /home/[INSERT USER FOLDER HERE]/appdata/swag:/config
    ports:
      - 443:443
      - 80:80
    networks:
      - [INSERT NETWORK NAME HERE]
    restart: unless-stopped

Next, you'll want to generate an API key :material-symbols-key-outline: with Cloudflare :simple-icons-cloudflare:, go to Overview in your domain, and click "get your api token", click Create Token, use → "Edit zone DNS" template, add a permission, select "Account", → "Cloudflare Tunnel", → "Edit", under account resources, include your account, under zone resources, include your domain. Continue with setup, make sure you keep track of the API key somewhere.

After you have completed these steps, you will need to add these credentials to your Swag configuration in the docker-compose.yml. After the Docker_Mods environment variable, add these lines:

version: "2.1"
services:
  swag:
    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Phoenix
      - URL=[sakura.nt]
      - VALIDATION=dns
      - SUBDOMAINS=wildcard
      - DNSPLUGIN=cloudflare
      - EMAIL=[sakurant@gmail.com]
      - ONLY_SUBDOMAINS=false
      #- EXTRA_DOMAINS= #optional
      - STAGING=false
      - DOCKER_MODS=linuxserver/mods:universal-docker|linuxserver/mods:swag-auto-reload|linuxserver/mods:swag-dashboard|linuxserver/mods:swag-dbip|linuxserver/mods:universal-cloudflared
      - CF_ZONE_ID=zone id from cloudflare domain overview // [!code focus]
      - CF_ACCOUNT_ID=account id from cloudflare domain overview // [!code focus]
      - CF_API_TOKEN=api token generated // [!code focus]
      - CF_TUNNEL_NAME=create a tunnel, name it whatever // [!code focus]
      - CF_TUNNEL_PASSWORD=generate a long password // [!code focus]
      - FILE__CF_TUNNEL_CONFIG=/config/tunnelconfig.yml // [!code focus]
    extra_hosts:
        - domain.tld:127.0.0.1
    volumes:
      - /home/[INSERT USER FOLDER HERE]/appdata/swag:/config
    ports:
      - 443:443
      - 80:80
    networks:
      - [INSERT NETWORK NAME HERE]
    restart: unless-stopped

You're not quite done yet... :cold-face:

You'll need to add more to finish the installation: First, nano /home/[USER]/appdata/swag/tunnelconfig.yml, and add these contents:

ingress:
  - hostname: domain.tld
    service: https://domain.tld
  - hostname: "*.domain.tld"
    service: https://domain.tld
  - service: http_status:404

Then, edit the /home/[USER]/appdata/swag/dns-conf/cloudflare.ini, add the API token, you'll comment the top two lines, add the token after uncommenting the bottom line.

:::details insert funni meeme here: :::