852: Cloudflare Tunnels

Explore the power of Cloudflare Tunnels with Scott and Wes as they break down this essential tool for secure remote server access. Learn how to establish and configure tunnels safely, integrate public webhooks with services like Snipcart and Apple Pay, and master the security practices that keep your connections protected. Show Notes 00:00 Welcome to Syntax! 01:17 Brought to you by Sentry.io. 02:09 How do Cloudflare Tunnels work? 03:52 Publicly exposed webhooks. 04:09 Apple Pay. 04:40 Snipcart. 04:54 Accessing servers when away. Jellyfin, Home Assistant. 07:47 How to set up Cloudflare Tunnels. 10:00 Security risks. Cloudflare Access & Zero Trust. Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:01Scott Tolinski?

  Welcome to Syntax on this Monday Hasty Treat. We're going to be talking about tunnels, Cloudflare tunnels, what they're used for, why they're neat, and we'll just all about getting them set up and what you might actually consider using a Cloudflare tunnel for. My name is Scott Tolinski. I'm a developer from Denver. With me as always is Wes Boss. What's up, Wes?

• 0:22Wes Bos?

  I'm excited to talk about this. We've done a show on exposing your application to the greater internet previously, and we've went through several of the options out there. You know, there's NGROK and local tunnel and whatnot. But Cloudflare tunnels is kind of in a league of its own because it does quite a bit more. And quite honestly, I think it's the best approach to these types of things in terms of like running them long-term, especially if you have like a local server at your house where you're not just like, "Oh, I have a local dev server that I want to be able to expose to somebody, but like, no, I want to run this thing full-time." So I thought, like, let's do a quick little show explaining what they are,

• 1:06Wes Bos?

  how to use them, the whys and whats, because they're super handy.

• 1:17Scott Tolinski?

  But before we do that, let's actually take a second to talk about Sentry at Sentry.io, perfect place to solve, find any of your bugs. I know we're doing a lot of side projects, Wes, and like, I know you're working on a bunch of stuff here and there. It's always important to know what's going on in your apps, whether that is performance, whether that is issues that cropped up. And hey, I was using some of these new GitHub tools to solve GitHub issues with natural text. It would be really kind of cool to take a Sentry issue, create a GitHub issue for it, have GitHub solve that thing for you right away. And it's like, click, click, all right, nice and done. Here's a bug solved. So check it out, Sentry.io/Syntax.

• 2:02Scott Tolinski?

  Sign up and get two months for free. You got to use the coupon code HASTYTREAT, all lowercase, all one word. And yeah, this podcast is presented by Sentry. And just like Wes, your websites get kind of presented by Cloudflare tunnels, meaning that you can basically put a Cloudflare tunnel in front of something.

• 2:22Scott Tolinski?

  And then point a domain to it. And then you have basically an SSL into something that is self-hosted, that's tunneled directly to your app. Do we first want to talk about what we might be hosting on CloudFlare Tunnels, or not hosting on, but using CloudFlare Tunnels to expose to the internet?

• 2:42Wes Bos?

  Yeah.

• 2:43Scott Tolinski?

  Just to give people an idea.

• 2:46Wes Bos?

  Okay, so there's, there's kind of like two, CloudFlare Tunnels is not just like, like, get your dev server open to the, to the greater internet. That is a very good use case for it.

• 2:56Scott Tolinski?

  It is. I've not done that, actually.

• 2:58Wes Bos?

  Oh, yeah. Yeah, I did it. So like, I'll start there. When I did my receipt printer, I was running some demos on my computer where I needed people to be able to send stuff to my receipt printer, right? And that question of how do you then expose your local dev server to the greater internet without exposing your home ad, home IP address, right? And so what I did is I ran a CloudFlare tunnel on my local machine. And what that does is it connected to a subdomain that I have, which is local.wesbos.com. And then anyone who's able to visit local.wesbos.com, it then pipes all the traffic directly to, it was piping it

• 3:41Wes Bos?

  directly to my dev server, my next JS dev server, and it held up pretty well. That's a really great use case, both for if you just want someone to see something, but also like, the, the use case I run into all the time is I have a webhook that I need to test, and the webhook needs to be exposed to the internet, because the webhook has to be pinged by another server. And it doesn't know how to ping my local, local host, right? Because it's not exposed to the internet. Apple Pay is another good one, where Apple Pay, you must give it the explicit domain names of what it is you're working with. And if you've not approved, basically you have to go into either Stripe or into Apple and

• 4:23Wes Bos?

  say like, wesbos.com is my domain name. And then you have to approve it and get it added to your account. And if you want To be able to test Apple Pay, you can't just do that on localhost, right? You have to have a domain name for that. So in that case, I'll often expose it to that. I've used Snip card in the past where that expects an exposed one. Anytime you're working with something that needs a web accessible URL, a CloudFlare tunnel is a great solution to that.

• 4:53Scott Tolinski?

  Yeah, yeah, I pretty much exclusively use this stuff for exposing services that are running locally to the internet. You know, think about like, we have an MB server to have like a media server on. And I want to make sure that we can access that on the airplane or when we're on vacation or something like, if we're somewhere and we need to download movies for the kids, it's nice to have that stuff available. Also have like my home assistant or the access to my NAS itself. Instead of using QuickConnect, I have that behind a CloudFlare tunnel. So I'm often using it exactly for those types of services, the types of things you'd want to access outside of your house. Most recently for me, the audiobook app, that audiobook shelf app that I have,

• 5:38Scott Tolinski?

  made that available. And I just throw it behind a domain. You get SSL, you don't have to worry about opening ports, and it feels a lot more comfortable. Not only that, but like, the process of getting a CloudFlare tunnel up on something like a Synology or NAS is trivial.

• 5:53Wes Bos?

  So easy. Like, it's amazing how much easier it is than some of the other... Like, I had been using Synology's version of this, which is synology.me, and it does this weird reverse proxy where... Because, maybe we should explain. If you have something hosted at your home, that is not exposed to the greater internet because you're going to have like, usually have one IP address for your router, right? Or sorry, for your modem. And then, if you were to visit that IP address, your router is, you have to go in like forward ports, and that's not necessarily really safe. So what this does is you can, you don't have to forward any ports. You don't have to deal with any routers, but it will sort of just forward the traffic on through to you.

• 6:37Wes Bos?

  I use it for, yeah, Home Assistant. I use it for my Jellyfin, because I want... To be able to stream our content when we are on the road or we're at the cottage, but the stuff is still at home. I like that quite a bit because if I have to download something, I can just log in to my Synology and download something on my fast internet here. And then you can stream it at like a lower quality on the devices on some slower internet. So I did that, but then I also hooked it up to my Coolify, which is really neat because so Coolify is like, kind of like a self-hosted Vercel where you can just quickly spin up a whole bunch of different options. And one kind of cool thing about Coolify is that you can give them each of your like boxes,

• 7:22Wes Bos?

  domain names. And if you give them publicly facing domain names, you I've set up a wildcard on my Cloudflare tunnels so that I can simply just, I could spin up like a syntax is cool. And then I immediately will assign a domain name to that in Coolify and then it will be web accessible for anyone.

• 7:41Scott Tolinski?

  I got a question about that. So how are you pointing the DNS then? You're pointing the DNS.

• 7:47Wes Bos?

  Yes. So let's talk about how you do that. So the, the way that you set up Cloudflare tunnels is there's kind of two ways. You can do it locally with the cloud flared kind of CLI. And that's the way I initially get into it. And that's the way they give you like a quick start, right? You can type this, you can type a couple of commands and immediately have a thing running. But I'm going to tell you, don't do that because that's not great long-term. And switching to the, the other approach, which is remotely managed, is the best approach. So what you do is you get the cloud flared daemon or daemon? How do you, how do you say that?

• 8:24Scott Tolinski?

  I think we've, I think we determined it was daemon.

• 8:27Wes Bos?

  Daemon. You get the Cloudflare daemon running on the box that if it's your, it might be your, your local server. In my case, I ran in a Docker container on my Synology, but then you expose it to the network on the Synology. Or you can just run it like directly on your, your MacBook Pro. And then that daemon is always running on your machine. You simply just go into the Cloudflare Tunnels UI and you can start setting up routes. And, and all I have to do is say star dot, I'm pretty sure it's like star dot coolify dot westboss.com. And then any applications that hit that route are passed to Coolify.

• 9:11Wes Bos?

  And then cool, at that point, Coolify picks it up and they have their own proxying setup. So that you, it'll say, oh, well, someone's requesting it on this URL, pass it to, to this one.

• 9:21Scott Tolinski?

  Interesting. I've always just done for Coolify. And this is kind of a pain is just create a second DNS record for any subdomain or any, yeah, any subdomain pointing to the IP of Coolify to get that, that custom domain going. Interesting that I like the wildcard approach. That seems like way more flexible.

• 9:39Wes Bos?

  It also depends on if you're hosting Coolify on like a, like a Hetzner box. That is like the IP address is already out there. Or if you are like, I'm running Coolify on my, my local server just in my house. So I don't have, I don't have an IP address. Well, I do have an IP address, but you should not be giving that IP address out. Because generally it's not a good idea for anyone to know the IP address of your server. Because they can go directly to that and, and give you a DDoS. Now you can obviously firewall it and, and only allow in certain IP addresses. But it's generally better to sort of mask that with something like a Cloudflare, where it will proxy all of the traffic for you. Yeah.

• 10:23Scott Tolinski?

  I like raising my hand now. The audio listeners, I raise my hand sometimes so we don't talk over West. But you don't have to have like a C name for these or what? Cause I have to have a C name for each subdomain that I have, even if it's Cloudflare Tunnled. Yeah.

• 10:35Wes Bos?

  The, the kind of cool thing is that if your domain name is set up with Cloudflare, then Cloudflare takes care of all the, all the DNS. Because Cloudflare is the DNS provider. So when a request comes to your server.

• 10:52Wes Bos?

  Cloudflare, as long as you're proxying it, which is orange clouding, Cloudflare will know what to do with that request and send it to the right, whether it's a cached asset or if it's actually like a tunnel that it needs then forward on to you.

• 11:06Scott Tolinski?

  Okay.

• 11:07Wes Bos?

  Yeah, it's really nice and you can just quickly go and you can either add like a one-off. You say basically like jellyfin.bossefamily.net and then that will, you say, okay, when somebody visits this URL, then point them to localhost:4265, you know, or 4498. And what that does is it will proxy it through to the port. And then you also have the benefit of not having to fuss with having ports in your URLs. It's just like a nice, clean URL. You can also do like subdomains as well. Like you could do like scotttalinsky.com/jellyfin or forward slash newblog.

• 11:49Wes Bos?

  However, I find that when you do like subdomains, then you have to get into like application-specific properties that is like, you know, like when you try host like a React or Svelte app on a, like a forward slash, then you have to tell the router itself what the base name is and then it's a bit of a pain.

• 12:07Scott Tolinski?

  Yeah. For people looking for this, it's under on Cloudflare in their dashboard. It's under Zero Trust, by the way. It's not like under Cloudflare tunnels on the sidebar. It's under Zero Trust, which then has a lot of other features. What's shocking about Zero Trust is that there's no dark theme for Zero Trust. So even if you're in dark mode, you go to Zero Trust and it's light mode.

• 12:25Wes Bos?

  You don't trust people that use dark mode. It's, they're hackers.

• 12:29Scott Tolinski?

  They're hackers. One thing that's really cool about these things also that we haven't mentioned is that you can give like a lock to some of these routes. So let's say you want this to be available, but

• 12:44Scott Tolinski?

  You know, this makes less sense for something like Home Assistant, where you're giving it a URL and creds and it's logging into that service. But if I have a service that's a web UI that I'm only ever visiting from the web, you can put a lock on that, which means that only certain CloudFlare accounts specifically can access that information. And so what happens when I visit those URLs, CloudFlare actually steps in with its own login page and says, "You must log into CloudFlare to access this." And then, once I do that, I might still get another login screen from the service itself. So even though you are exposing this functionality to the web,

• 13:25Scott Tolinski?

  it does give a nice bit of protection there in terms of who's even able to even hit the site in general, not just, you know, try to log in.

• 13:35Wes Bos?

  So CloudFlare's whole zero trust thing is like this massive product. It's meant for enterprise, which is, we have stuff that is hosted and it needs to be accessible via the entire internet. However, like, you know, it's annoying that you have to set up the VPN and like, "Oh, are you on the VPN before you can reach that?" Like, that's, you don't have to do that. You can simply just make access rules to say, "All right, anybody with this domain is able to access it," or you can hook up to any of the single sign-on providers. And you can simply just give somebody a code, right? Like, that's one thing is like, if you do want to expose your local dev server to the

• 14:16Wes Bos?

  internet, you probably don't want anyone just like finding that while you're working on it, because there could be sensitive stuff on there. So you could just put like a PIN code in front of it. And if you do need someone to be able to access it, it's kind of annoying, because if that's the case, then you have to write some rules for the webhooks to be able to go through. But you can lock this stuff down as much as you want, even if, like Scott says, even if your applications themselves already have.

• 14:45Wes Bos?

  Like a login, right?

• 14:46Scott Tolinski?

  Yeah.

• 14:47Wes Bos?

  Because like there's at some point, there's going to be some sort of security flaw for these applications, you know, at some point, there's going to be some security flaw in my photo backup software.

• 14:59Scott Tolinski?

  Or home assistant, or you know, I don't want to give anybody access to my home assistant.

• 15:04Wes Bos?

  Especially you got cameras in there, right?

• 15:06Scott Tolinski?

  Like, I don't have cameras in mine, but yes. I don't want somebody, I don't want somebody to mess with my lights.

• 15:11Wes Bos?

  Yeah, or even simply know when you are home, right? They could see your, all that info. So yeah, you could, you could lock that down a little further to get access to it. So it's, it's a really cool product. I'm, it's really amazing that at a very low level, just like a guy like me can use it to give cool domain names to my servers. And then it spans all the way to like enterprise network IT, locking things down and doing custom routing.

• 15:44Scott Tolinski?

  Yeah, I know it's, it's, it's a cool, one, it's a cool product that works well, but it's also, it feels secure when you use it. I think for me personally, when I first started looking into making things like my MB server available off network, and it freaked me out, I'm going to be honest with you because like once you get into opening ports and I'm not as much of a network admin that like,

• 16:10Wes Bos?

  Yeah.

• 16:10Scott Tolinski?

  I know that I'm making the right choices on everything. So being able to use Cloudflare tunnels to me has been really just a big, big, nice little boost for me.

• 16:21Wes Bos?

  Yeah.

• 16:22Scott Tolinski?

  Feeling more secure about what I'm doing here. So yeah, it's a, it's a cool product.

• 16:27Wes Bos?

  You should see like, when I log into my Synology, it shows you when people are trying to log in. And it's, it's probably, I don't know, like, like a hundred a day login attempts. Yeah, yeah, it's, it's nuts.

• 16:44Scott Tolinski?

  I don't think mine is.

• 16:45Wes Bos?

  There's just bots out there. If you do a search, just everybody's, yeah, there's just bots out there looking for Synology login pages and looking for unsecured, you know, there's bots everywhere and they will try admin, admin and admin puppy and all these things, which is, is pretty, pretty wild. And obviously they never get in because I have like two factor authentication and whatnot, but I kind of would like them to not. Even try because like you know that a request is coming into my home and trying to access it, you know?

• 17:20Scott Tolinski?

  I know that freaks me out and if you have like the like the tunnel lock to make sure that like somebody has to hit a login before they hit that, then they're not even getting to your home.

• 17:30Wes Bos?

  Yeah.

• 17:31Scott Tolinski?

  And that to me feels feels great. Yeah, I yeah, that that whole Synology thing is freaky to me as well. But yeah, if I could have, that's like one of the services, if I could have free FA on it for FA, just give me like all the FA's, I'll do it.

• 17:46Wes Bos?

  For FA.

• 17:47Scott Tolinski?

  Yeah, I don't need the inconvenience, does not matter to me. I just don't want somebody getting into my NAS and deleting all my stuff.

• 17:54Wes Bos?

  Yeah, yeah. All right. I think that's all we have. Certainly check them out. Grab a Cloudflare Tunnel, try to get a setup like a local dot whatever, even buy like a whole new domain name. There's an excuse for you can buy a new domain name, but.

• 18:08Scott Tolinski?

  Yes.

• 18:09Wes Bos?

  Buy a domain name for your projects and then just try set up like a local one. You can also just proxy other applications as well, right? It doesn't have to be something locally hosted. It could be an actual application that's on on a server somewhere as well.

• 18:26Scott Tolinski?

  Yeah, don't you just have to, you would just have to have Cloudflare Demon running? That's, that's the only thing.

• 18:32Wes Bos?

  Yeah, you have to have that running on your box.

• 18:35Scott Tolinski?

  Yep. Word. Cool. Well, I hope you found this interesting and let us know what you're hosting on Cloudflare Tunnels. If you use something different, like something else, or you're just not convinced, let us know in the comments down below. Smash that subscribe button, all that good stuff, and we'll see you in the next one.

• 18:49Wes Bos?

  Peace.