Skip to content

Commit 909e845

Browse files
ranbelranbel
committed
create tunnel using Terraform
1 parent ae9d7cd commit 909e845

File tree

3 files changed

+145
-44
lines changed

3 files changed

+145
-44
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api.mdx‎

Lines changed: 1 addition & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -142,49 +142,7 @@ To configure Zero Trust policies and connect as a user, refer to [Connect privat
142142

143143
Install `cloudflared` on your server and run the tunnel using the `token` value obtained in [2. Create a tunnel](#2-create-a-tunnel). You can also get the tunnel token using the [Cloudflare Tunnel token](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/token/methods/get/) endpoint.
144144

145-
<Tabs> <TabItem label="Linux">
146-
147-
1. [Download and install](https://pkg.cloudflare.com/index.html) `cloudflared`.
148-
149-
2. Run the following command:
150-
151-
```sh
152-
sudo cloudflared service install <tunnel-token>
153-
```
154-
155-
</TabItem> <TabItem label="Windows">
156-
157-
1. [Download and install](/cloudflare-one/connections/connect-networks/downloads/#windows) `cloudflared`.
158-
159-
2. Open Command Prompt as administrator.
160-
161-
3. Run the following command:
162-
163-
```txt
164-
cloudflared.exe service install <tunnel-token>
165-
```
166-
167-
</TabItem> <TabItem label="macOS">
168-
169-
1. [Download and install](/cloudflare-one/connections/connect-networks/downloads/#macos) `cloudflared`.
170-
171-
2. Run the following command:
172-
173-
```sh
174-
sudo cloudflared service install <tunnel-token>
175-
```
176-
177-
</TabItem> <TabItem label="Docker">
178-
179-
1. Open a terminal window.
180-
181-
2. Run the following command:
182-
183-
```sh
184-
docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token <tunnel-token>
185-
```
186-
187-
</TabItem> </Tabs>
145+
<Render file="tunnel/install-and-run-tunnel" product="cloudflare-one" />
188146

189147
## 5. Verify tunnel status
190148

‎src/content/docs/learning-paths/replace-vpn/connect-private-network/cloudflared.mdx‎

Lines changed: 94 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,113 @@ sidebar:
66

77
---
88

9-
import { Render } from "~/components"
9+
import { Render, Tabs, TabItem, Details } from "~/components"
1010

1111
Cloudflare Tunnel is an outbound-only daemon service that can run on nearly any host machine and proxies local traffic once validated from the Cloudflare network. User traffic initiated from the WARP endpoint client onramps to Cloudflare, passes down your Cloudflare Tunnel connections, and terminates automatically in your local network. Traffic reaching your internal applications or services will carry the local source IP address of the host machine running the `cloudflared` daemon.
1212

1313
## Create a tunnel
1414

1515
To connect your private network:
1616

17+
<Tabs syncKey="dashPlusAPI">
18+
19+
<TabItem label="Dashboard">
20+
1721
<Render file="tunnel/create-tunnel" product="cloudflare-one" />
1822

1923
9. In the **Private Networks** tab, enter the CIDR of your private network (for example, `10.0.0.0/8`).
2024

2125
10. Select **Save tunnel**.
2226

27+
</TabItem>
28+
<TabItem label="Terraform (v5)">
29+
30+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):
31+
- `Cloudflare Tunnel Write`
32+
33+
2. Generate a secret for the tunnel using Terraform's [`random` provider](https://registry.terraform.io/providers/hashicorp/random/latest/docs):
34+
35+
```tf
36+
resource "random_bytes" "tunnel_secret" {
37+
length = 64
38+
}
39+
```
40+
41+
3. Create a tunnel using the [`cloudflare_zero_trust_tunnel_cloudflare`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared) resource.
42+
43+
```tf
44+
resource "cloudflare_zero_trust_tunnel_cloudflared" "example_tunnel" {
45+
account_id = var.cloudflare_account_id
46+
name = "Example tunnel"
47+
tunnel_secret = random_bytes.tunnel_secret.base64
48+
config_src = "cloudflare"
49+
}
50+
```
51+
52+
4. Route the CIDR of your private network through the tunnel using the [`cloudflare_zero_trust_tunnel_cloudflared_route`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared_route) resource:
53+
54+
```tf
55+
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "example_tunnel_route" {
56+
account_id = var.cloudflare_account_id
57+
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.example_tunnel.id
58+
network = "10.0.0.0/8"
59+
comment = "Example tunnel route"
60+
}
61+
```
62+
63+
5. Get the [token](/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions/) used to run the tunnel:
64+
65+
```tf
66+
data "cloudflare_zero_trust_tunnel_cloudflared_token" "tunnel_token" {
67+
account_id = var.cloudflare_account_id
68+
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.example_tunnel.id
69+
}
70+
```
71+
72+
If your host machine is not managed in Terraform or you want to install the tunnel manually, you can output the token value to the CLI.
73+
<Details header="Example: Output to CLI" open = {false}>
74+
1. Output the tunnel token to the Terraform state file:
75+
```tf
76+
output "tunnel_token" {
77+
value = data.cloudflare_zero_trust_tunnel_cloudflared_token.tunnel_token.token
78+
sensitive = true
79+
}
80+
```
81+
2. Apply the configuration:
82+
```sh
83+
terraform apply
84+
```
85+
3. Read the tunnel token:
86+
```sh
87+
terraform output -raw tunnel_token
88+
```
89+
```sh output
90+
eyJhIj...
91+
```
92+
93+
</Details>
94+
95+
Alternatively, pass `data.cloudflare_zero_trust_tunnel_cloudflared_token.tunnel_token.token` directly into your host's Terraform configuration or store the token in your secret management tool.
96+
97+
<Details header="Example: Store in HashiCorp Vault" open = {false}>
98+
```tf
99+
resource "vault_generic_secret" "tunnel_token" {
100+
path = "kv/cloudflare/tunnel_token"
101+
102+
data_json = jsonencode({
103+
"TUNNEL_TOKEN" = data.cloudflare_zero_trust_tunnel_cloudflared_token.tunnel_token.token
104+
})
105+
}
106+
```
107+
</Details>
108+
109+
6. Install `cloudflared` on a host machine in your private network and run the tunnel:
110+
111+
<Render file="tunnel/install-and-run-tunnel" product="cloudflare-one" />
112+
113+
</TabItem>
114+
</Tabs>
115+
23116
All internal applications and services in this IP range are now connected to Cloudflare.
24117

25118
:::note

‎src/content/partials/cloudflare-one/tunnel/install-and-run-tunnel.mdx‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
{}
3+
4+
---
5+
6+
import { Tabs, TabItem } from "~/components";
7+
8+
<Tabs> <TabItem label="Linux">
9+
10+
1. [Download and install](https://pkg.cloudflare.com/index.html) `cloudflared`.
11+
12+
2. Run the following command:
13+
14+
```sh
15+
sudo cloudflared service install <TUNNEL_TOKEN>
16+
```
17+
18+
</TabItem> <TabItem label="Windows">
19+
20+
1. [Download and install](/cloudflare-one/connections/connect-networks/downloads/#windows) `cloudflared`.
21+
22+
2. Open Command Prompt as administrator.
23+
24+
3. Run the following command:
25+
26+
```txt
27+
cloudflared.exe service install <TUNNEL_TOKEN>
28+
```
29+
30+
</TabItem> <TabItem label="macOS">
31+
32+
1. [Download and install](/cloudflare-one/connections/connect-networks/downloads/#macos) `cloudflared`.
33+
34+
2. Open a terminal window and run the following command:
35+
36+
```sh
37+
sudo cloudflared service install <TUNNEL_TOKEN>
38+
```
39+
40+
</TabItem> <TabItem label="Docker">
41+
42+
1. Open a terminal window.
43+
44+
2. Run the following command:
45+
46+
```sh
47+
docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token <TUNNEL_TOKEN>
48+
```
49+
50+
</TabItem> </Tabs>

0 commit comments

Comments
 (0)