Cloudflare tunnel support

[bgervan]

Is there any plan supporting cloudflare tunnels (cloudflared) to expost web apps?

[scart88]

I'm using Caddy as a load balancer to reverse proxy into private VMs.

You could use cloudflared to achieve that as well...

[MikeChongCan]

Could you share a code snippets?

[jeremy]

No plans for native support.

You can experiment with deploying cloudflared as a Kamal accessory, though, and having it target an alternate Traefik entrypoint.

Odds are good you can wire it up without additional support from Kamal.

[MikeChongCan]

Thanks @jeremy !

I'm sharing my config:

accessories:
  cloudflared:
    image: cloudflare/cloudflared:2024.6.0
    host: 192.168.3.80
    port: 10801
    env:
      secret:
        - TUNNEL_TOKEN
    cmd: tunnel run
# Configure custom arguments for Traefik. Be sure to reboot traefik when you modify it.
traefik:
  host_port: 18081
  args:
    accesslog: true

it works perfectly.

[ngtrieuvi92]

thanks @imWildCat, thank for your sharing, that's work perfectly.
In my configuration, I just add and external docker network for cloudflared, app and traefik, then in tunnel config, I can point domain directly into http://traefik:80

accessories:
  cloudflared:
    image: cloudflare/cloudflared:2024.6.0
    host: 136.20.33.21
    env:
      secret:
        - TUNNEL_TOKEN
    cmd: tunnel run
    options:
      network: "pff"

# Configure custom arguments for Traefik
traefik:
  options:
    network: "pff"
  args:
    accesslog: true
    entryPoints.web.address: ":80"
  labels:
    traefik.enable: true

I also wrap up it into a short post https://vinguyen.blog/secure-website-hosting-without-open-ports-cloudflare-tunnel-and-kamal-deploy/

[MikeChongCan]

awesome! thanks for the writing!

[scomma]

I struggled for a couple hours trying to get @imWildCat's solution to work with Kamal 2, which uses kamal-proxy in lieu of traefik. Turns out the cloudflared accessory runs in a special network where it can't directly connect to the host machine's port 80.

To solve this, inside Cloudflare website's tunnel configuration, set the target to kamal-proxy's container directly.

[pdobb]

@scomma Would you be able to share your relevant config for Kamal 2? Also, I don't see anything under "Networks" in Cloudflare, let alone "Tunnels" anywhere... (Never mind. I now see I needed to create a Zero Trust team to access this.)

Thanks for any help as Kamal 2 documentation is pretty sparse still!

[hktang]

Thank you for your information @scomma and @pdobb. I set up the tunnel as an accessory, and created a public host name that points to http://kamal-proxy:80. The tunnel is active, but I am seeing ERR_TOO_MANY_REDIRECTS when I visit the public host name.

What would be the problem? Thanks in advance for any advice.

accessories:
  tunnel:
    image: cloudflare/cloudflared:2025.2.0
    host: 123.123.123.123
    env:
      secret:
        - TUNNEL_TOKEN
    cmd: tunnel run

To be clear, we don't need traefik as accessory or any custom network in Kamal 2.

[MikeChongCan]

@hktang disable https auto redirect?

[hktang]

Thank you @imWildCat! I turned off SSL in kamal-proxy for the app, and then it works like a charm.

proxy:
  ssl: false
  hosts:
    - example.com

It seems Cloudflare SSL full/strict/flexible mode can only be set at the domain level, but not individual subdomain level, right? Turning SSL to flexible might work but it will affect other subdomains which use full SSL mode.

[sdecourcel]

Kamal 2.7.0 + Cloudflare Origin Certificate + cloudflare/cloudflared:2025.7.0 image

I finally made cloudflare tunnel work with custom certificate + ssl_redirect: false

proxy:

	ssl:

		certificate_pem: CERTIFICATE_PEM

		private_key_pem: PRIVATE_KEY_PEM

	host: my.great.url

	forward_headers: true

	app_port: 3000

	ssl_redirect: false

AND that configuration for the tunnel (NO https - NO port):

http://kamal-proxy

[wiemann]

Once I deploy the second app on that server in conjunction with Cloudflare tunnel as also discussed here, I get the following error on deployment:

Error: host settings conflict with another service

probably due to a name conflict with the other proxy. any way to change the proxy host name http://kamal-proxy to something else per deployment?

[leonardo2204]

Did you ever figure this out?

[wiemann]

unfortunately no

[leonardo2204]

@wiemann giving some thought, I actually did not understand what you mean, and I got it working on the same machine (hetzner) using the same tunnel, but different connectors. Here are my configs:

servers:
  web:
    hosts:
      - <my_ssh>
accessories:
  cloudflared:
    image: cloudflare/cloudflared:latest
    role: web
    cmd: tunnel --no-autoupdate run
    env:
      secret:
        - TUNNEL_TOKEN

Hope it helps somehow :D

[wiemann]

good to know. Thanks.