|
1 | 1 | --- |
2 | 2 | pcx_content_type: how-to |
3 | | -title: Remotely-managed tunnel |
| 3 | +title: Tunnel permissions |
4 | 4 | sidebar: |
5 | | - order: 1 |
| 5 | + order: 10 |
6 | 6 | --- |
7 | 7 |
|
8 | 8 | import { TabItem, Tabs, Render } from "~/components"; |
9 | 9 |
|
10 | | -If you created a Cloudflare Tunnel [from the dashboard](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/), the tunnel runs as a service on your OS. |
11 | | - |
12 | | -## Add tunnel run parameters |
13 | | - |
14 | | -You can modify the Cloudflare Tunnel service with one or more [general-purpose tunnel parameters](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-run-parameters/). |
15 | | - |
16 | | -<Tabs> <TabItem label="Linux"> |
17 | | - |
18 | | -On Linux, Cloudflare Tunnel installs itself as a system service using `systemctl`. By default, the service will be named `cloudflared.service`. To configure your tunnel on Linux: |
19 | | - |
20 | | -1. Open `cloudflared.service`. |
21 | | - |
22 | | - ```sh |
23 | | - sudo systemctl edit --full cloudflared.service |
24 | | - ``` |
25 | | - |
26 | | -2. Modify the `cloudflared tunnel run` command with the desired configuration flag. For example, |
27 | | - |
28 | | - ```txt null {8} |
29 | | - [Unit] |
30 | | - Description=Cloudflare Tunnel |
31 | | - After=network.target |
32 | | -
|
33 | | - [Service] |
34 | | - TimeoutStartSec=0 |
35 | | - Type=notify |
36 | | - ExecStart=/usr/local/bin/cloudflared tunnel --loglevel debug --logfile /var/log/cloudflared/cloudflared.log run --token <TOKEN VALUE> |
37 | | - Restart=on-failure |
38 | | - RestartSec=5s |
39 | | -
|
40 | | - [Install] |
41 | | - WantedBy=multi-user.target |
42 | | - ``` |
43 | | - |
44 | | -3. Restart `cloudflared.service`: |
45 | | - |
46 | | - ```sh |
47 | | - sudo systemctl restart cloudflared |
48 | | - ``` |
49 | | - |
50 | | -4. To verify the new configuration, check the service status: |
51 | | - |
52 | | - ```sh |
53 | | - sudo systemctl status cloudflared |
54 | | - ``` |
55 | | - ```sh output |
56 | | - ● cloudflared.service - cloudflared |
57 | | - Loaded: loaded (/etc/systemd/system/cloudflared.service; enabled; preset: enabled) |
58 | | - Active: active (running) since Wed 2024-10-09 20:02:59 UTC; 2s ago |
59 | | - Main PID: 2157 (cloudflared) |
60 | | - Tasks: 8 (limit: 1136) |
61 | | - Memory: 16.3M |
62 | | - CPU: 136ms |
63 | | - CGroup: /system.slice/cloudflared.service |
64 | | - └─2157 /usr/bin/cloudflared tunnel --loglevel debug --logfile /var/log/cloudflared/cloudflared.log run --token eyJhIjoi... |
65 | | - ``` |
66 | | - |
67 | | -</TabItem> <TabItem label="macOS"> |
68 | | - |
69 | | -On macOS, Cloudflare Tunnel installs itself as a launch agent using `launchctl`. By default, the agent will be called `com.cloudflare.cloudflared`. To configure your tunnel on macOS: |
70 | | - |
71 | | -1. Stop the `cloudflared` service. |
72 | | - |
73 | | - ```sh |
74 | | - sudo launchctl stop com.cloudflare.cloudflared |
75 | | - ``` |
76 | | - |
77 | | -2. Unload the configuration file. |
78 | | - |
79 | | - ```sh |
80 | | - sudo launchctl unload /Library/LaunchDaemons/com.cloudflare.cloudflared.plist |
81 | | - ``` |
82 | | - |
83 | | -3. Open `/Library/LaunchDaemons/com.cloudflare.cloudflared.plist` in a text editor. |
84 | | - |
85 | | -4. Modify the `ProgramArguments` key with the desired configuration flag. For example, |
86 | | - |
87 | | - ```txt |
88 | | - <plist version="1.0"> |
89 | | - <dict> |
90 | | - <key>Label</key> |
91 | | - <string>com.cloudflare.cloudflared</string> |
92 | | - <key>ProgramArguments</key> |
93 | | - <array> |
94 | | - <string>/opt/homebrew/bin/cloudflared</string> |
95 | | - <string>tunnel</string> |
96 | | - <string>--logfile</string> |
97 | | - <string><PATH></string> |
98 | | - <string>--loglevel</string> |
99 | | - <string>debug</string> |
100 | | - <string>run</string> |
101 | | - <string>--token</string> |
102 | | - <string><TOKEN VALUE> </string> |
103 | | - </array> |
104 | | - ``` |
105 | | - |
106 | | -5. Load the updated configuration file. |
107 | | - |
108 | | - ```sh |
109 | | - sudo launchctl load /Library/LaunchDaemons/com.cloudflare.cloudflared.plist |
110 | | - ``` |
111 | | - |
112 | | -6. Start the `cloudflared` service. |
113 | | - |
114 | | - ```sh |
115 | | - sudo launchctl start com.cloudflare.cloudflared |
116 | | - ``` |
117 | | - |
118 | | -</TabItem> <TabItem label="Windows"> |
119 | | - |
120 | | -On Windows, Cloudflare Tunnel installs itself as a system service using the Registry Editor. By default, the service will be named `cloudflared`. To configure your tunnel on Windows: |
121 | | - |
122 | | -1. Open the Registry Editor. |
123 | | - |
124 | | -2. Go to **HKEY_LOCAL_MACHINE** > **SYSTEM** > **CurrentControlSet** > **Services** > **cloudflared**. |
125 | | - |
126 | | -3. Double-click **ImagePath**. |
127 | | - |
128 | | -4. Modify **Value data** with the desired configuration flag. For example, |
129 | | - |
130 | | - ```txt |
131 | | - C:\Program Files (x86)\cloudflared\.\cloudflared.exe tunnel --loglevel debug --logfile <PATH> run --token <TOKEN VALUE> |
132 | | - ``` |
133 | | - |
134 | | - |
135 | | - |
136 | | -</TabItem> </Tabs> |
137 | | - |
138 | | -## Update origin configuration |
139 | | - |
140 | | -To configure how `cloudflared` sends requests to your [public hostname](/cloudflare-one/connections/connect-networks/routing-to-tunnel/) services: |
141 | | - |
142 | | -1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Networks** > **Tunnels**. |
143 | | -2. Choose a tunnel and select **Configure**. |
144 | | -3. Select the **Public Hostname** tab. |
145 | | -4. Choose a route and select **Edit**. |
146 | | -5. Under **Additional application settings**, modify one or more [origin configuration parameters](/cloudflare-one/connections/connect-networks/configure-tunnels/origin-configuration/). |
147 | | -6. Select **Save hostname**. |
148 | | - |
149 | | -## Tunnel permissions |
150 | | - |
151 | 10 | A remotely-managed tunnel only requires the tunnel token to run. Anyone with access to the token will be able to run the tunnel. |
152 | 11 |
|
153 | | -### View the tunnel token |
| 12 | +## View the tunnel token |
154 | 13 |
|
155 | 14 | To get the token for a remotely-managed tunnel: |
156 | 15 |
|
@@ -178,7 +37,7 @@ Make a `GET` request to the [Cloudflare Tunnel token](/api/resources/zero_trust/ |
178 | 37 | </TabItem> |
179 | 38 | </Tabs> |
180 | 39 |
|
181 | | -### Rotate a token without service disruption |
| 40 | +## Rotate a token without service disruption |
182 | 41 |
|
183 | 42 | Cloudflare recommends rotating the tunnel token at a regular cadence to reduce the risk of token compromise. You can rotate a token with minimal disruption to users as long as the tunnel is served by at least two [`cloudflared` replicas](/cloudflare-one/connections/connect-networks/deploy-tunnels/deploy-cloudflared-replicas/). To ensure service availability, we recommend performing token rotations outside of working hours or in a maintenance window. |
184 | 43 |
|
@@ -272,7 +131,7 @@ To rotate a tunnel token: |
272 | 131 |
|
273 | 132 | The tunnel token is now fully rotated. The old token is no longer in use. |
274 | 133 |
|
275 | | -### Rotate a compromised token |
| 134 | +## Rotate a compromised token |
276 | 135 |
|
277 | 136 | If your tunnel token is compromised, we recommend taking the following steps: |
278 | 137 |
|
@@ -304,6 +163,6 @@ If your tunnel token is compromised, we recommend taking the following steps: |
304 | 163 |
|
305 | 164 | The tunnel token is now fully rotated. The old token is no longer in use. |
306 | 165 |
|
307 | | -### Account-scoped roles |
| 166 | +## Account-scoped roles |
308 | 167 |
|
309 | 168 | <Render file="tunnel/account-scoped-roles" /> |
0 commit comments