Secure Remote Access with Cloudflare Tunnels#

1
tunnel: YOUR_TUNNEL_UUID_HERE
2
credentials-file: /home/user/.cloudflared/YOUR_TUNNEL_UUID_HERE.json
3

4
# Global settings
5
protocol: http2
6
no-autoupdate: false
7
retries: 5
8
grace-period: 30s
9

10
# Logging configuration
11
log-level: info
12
log-file: /var/log/cloudflared.log
13

14
# Ingress rules (order matters - first match wins)
15
ingress:
16
  # Web application with custom headers
17
  - hostname: webapp.example.com
18
    service: http://localhost:3000
19
    originRequest:
20
      noTLSVerify: false
21
      connectTimeout: 30s
22
      tlsTimeout: 10s
23
      httpHostHeader: webapp.internal
24

25
  # API server with authentication
26
  - hostname: api.example.com
27
    service: https://api-server.internal:8443
28
    originRequest:
29
      caPool: /etc/ssl/internal-ca.pem
30
      originServerName: api-server.internal
31
      keepAliveConnections: 100
32
      keepAliveTimeout: 90s
33

34
  # SSH access via browser
35
  - hostname: ssh.example.com
36
    service: ssh://bastion.internal:22
37
    originRequest:
38
      bastionMode: true
39

40
  # RDP access
41
  - hostname: rdp.example.com
42
    service: rdp://windows-server.internal:3389
43

44
  # Database admin tool
45
  - hostname: pgadmin.example.com
46
    service: http://pgadmin.internal:5050
47
    originRequest:
48
      noTLSVerify: true
49
      httpHostHeader: pgadmin.internal
50

51
  # File server with WebDAV
52
  - hostname: files.example.com
53
    service: http://fileserver.internal:8080
54
    originRequest:
55
      disableChunkedEncoding: false
56

57
  # Monitoring dashboard
58
  - hostname: grafana.example.com
59
    service: http://monitoring.internal:3000
60
    originRequest:
61
      connectTimeout: 60s
62

63
  # Development server with WebSocket support
64
  - hostname: dev.example.com
65
    service: http://dev-server.internal:4000
66
    originRequest:
67
      disableChunkedEncoding: true
68

69
  # Legacy HTTP service
70
  - hostname: legacy.example.com
71
    service: http://old-system.internal:80
72
    originRequest:
73
      httpHostHeader: legacy.example.com
74
      originServerName: old-system.internal
75

76
  # Load balanced service
77
  - hostname: app-cluster.example.com
78
    service: http://load-balancer.internal:8080
79
    originRequest:
80
      keepAliveConnections: 50
81
      keepAliveTimeout: 60s
82

83
  # Catch-all rule (must be last)
84
  - service: http_status:404
85

86
# Optional: HTTP/HTTPS proxy for egress traffic
87
proxy:
88
  - address: proxy.internal:8080
89
    port: 8080

1
version: '3.8'
2

3
services:
4
  cloudflared:
5
    image: cloudflare/cloudflared:latest
6
    container_name: cloudflared-tunnel
7
    restart: unless-stopped
8
    command: tunnel run
9
    environment:
10
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}
11
    volumes:
12
      - ./cloudflared:/etc/cloudflared:ro
13
    networks:
14
      - internal
15
    depends_on:
16
      - webapp
17
      - api
18

19
  webapp:
20
    image: nginx:alpine
21
    container_name: internal-webapp
22
    volumes:
23
      - ./webapp:/usr/share/nginx/html:ro
24
    networks:
25
      - internal
26

27
  api:
28
    image: your-api:latest
29
    container_name: internal-api
30
    environment:
31
      - NODE_ENV=production
32
    networks:
33
      - internal
34
    depends_on:
35
      - database
36

37
  database:
38
    image: postgres:15
39
    container_name: internal-db
40
    environment:
41
      - POSTGRES_DB=appdb
42
      - POSTGRES_USER=appuser
43
      - POSTGRES_PASSWORD=${DB_PASSWORD}
44
    volumes:
45
      - pgdata:/var/lib/postgresql/data
46
    networks:
47
      - internal
48

49
networks:
50
  internal:
51
    driver: bridge
52
    internal: false
53

54
volumes:
55
  pgdata:

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: cloudflared
5
  namespace: cloudflare-tunnel
6
spec:
7
  replicas: 2
8
  selector:
9
    matchLabels:
10
      app: cloudflared
11
  template:
12
    metadata:
13
      labels:
14
        app: cloudflared
15
    spec:
16
      containers:
17
      - name: cloudflared
18
        image: cloudflare/cloudflared:latest
19
        args:
20
        - tunnel
21
        - --config
22
        - /etc/cloudflared/config.yaml
23
        - run
24
        - production-tunnel
25

26
        livenessProbe:
27
          httpGet:
28
            path: /ready
29
            port: 8080
30
          initialDelaySeconds: 10
31
          periodSeconds: 10
32

33
        resources:
34
          requests:
35
            memory: "64Mi"
36
            cpu: "50m"
37
          limits:
38
            memory: "128Mi"
39
            cpu: "100m"
40

41
        volumeMounts:
42
        - name: config
43
          mountPath: /etc/cloudflared
44
          readOnly: true
45
        - name: credentials
46
          mountPath: /etc/cloudflared/credentials
47
          readOnly: true
48

49
      volumes:
50
      - name: config
51
        configMap:
52
          name: cloudflared-config
53
      - name: credentials
54
        secret:
55
          secretName: cloudflared-credentials
56

57
---
58
apiVersion: v1
59
kind: ConfigMap
60
metadata:
61
  name: cloudflared-config
62
  namespace: cloudflare-tunnel
63
data:
64
  config.yaml: |
65
    tunnel: YOUR_TUNNEL_UUID
66
    credentials-file: /etc/cloudflared/credentials/credentials.json
67
    metrics: 0.0.0.0:8080
68
    ingress:
69
    - hostname: k8s-app.example.com
70
      service: http://webapp-service.default.svc.cluster.local:80
71
    - hostname: k8s-api.example.com
72
      service: http://api-service.default.svc.cluster.local:8080
73
    - service: http_status:404
74

75
---
76
apiVersion: v1
77
kind: Secret
78
metadata:
79
  name: cloudflared-credentials
80
  namespace: cloudflare-tunnel
81
type: Opaque
82
data:
83
  credentials.json: BASE64_ENCODED_CREDENTIALS_JSON
84

85
---
86
apiVersion: v1
87
kind: Service
88
metadata:
89
  name: cloudflared-metrics
90
  namespace: cloudflare-tunnel
91
spec:
92
  selector:
93
    app: cloudflared
94
  ports:
95
  - name: metrics
96
    port: 8080
97
    targetPort: 8080

1
#!/usr/bin/env python3
2
import requests
3
import json
4
import time
5
import logging
6
from datetime import datetime
7

8
logging.basicConfig(level=logging.INFO)
9
logger = logging.getLogger(__name__)
10

11
class TunnelMonitor:
12
    def __init__(self, config_file="monitor-config.json"):
13
        with open(config_file, 'r') as f:
14
            self.config = json.load(f)
15

16
    def check_tunnel_health(self):
17
        """Check tunnel health via metrics endpoint"""
18
        try:
19
            response = requests.get(
20
                f"http://localhost:{self.config['metrics_port']}/metrics",
21
                timeout=10
22
            )
23
            response.raise_for_status()
24

25
            metrics = response.text
26

27
            # Parse key metrics
28
            total_requests = self.extract_metric(metrics, 'cloudflared_tunnel_total_requests')
29
            active_connections = self.extract_metric(metrics, 'cloudflared_concurrent_requests_per_tunnel')
30

31
            logger.info(f"Tunnel health OK - Requests: {total_requests}, Active: {active_connections}")
32
            return True
33

34
        except Exception as e:
35
            logger.error(f"Tunnel health check failed: {e}")
36
            return False
37

38
    def check_application_health(self):
39
        """Check if applications are reachable through tunnel"""
40
        results = {}
41

42
        for app in self.config['applications']:
43
            try:
44
                response = requests.get(
45
                    app['url'],
46
                    timeout=30,
47
                    headers=app.get('headers', {}),
48
                    verify=True
49
                )
50

51
                results[app['name']] = {
52
                    'status': 'healthy' if response.status_code == 200 else 'unhealthy',
53
                    'response_time': response.elapsed.total_seconds(),
54
                    'status_code': response.status_code
55
                }
56

57
                logger.info(f"App {app['name']}: {results[app['name']]}")
58

59
            except Exception as e:
60
                results[app['name']] = {
61
                    'status': 'error',
62
                    'error': str(e)
63
                }
64
                logger.error(f"App {app['name']} check failed: {e}")
65

66
        return results
67

68
    def extract_metric(self, metrics_text, metric_name):
69
        """Extract metric value from Prometheus format"""
70
        for line in metrics_text.split('\n'):
71
            if line.startswith(metric_name):
72
                return float(line.split()[-1])
73
        return 0
74

75
    def send_alert(self, message):
76
        """Send alert notification"""
77
        if 'webhook_url' in self.config:
78
            payload = {
79
                'text': f"Cloudflare Tunnel Alert: {message}",
80
                'timestamp': datetime.now().isoformat()
81
            }
82

83
            try:
84
                requests.post(
85
                    self.config['webhook_url'],
86
                    json=payload,
87
                    timeout=10
88
                )
89
            except Exception as e:
90
                logger.error(f"Failed to send alert: {e}")
91

92
    def run_checks(self):
93
        """Run all health checks"""
94
        tunnel_healthy = self.check_tunnel_health()
95
        app_results = self.check_application_health()
96

97
        if not tunnel_healthy:
98
            self.send_alert("Tunnel health check failed")
99

100
        unhealthy_apps = [name for name, result in app_results.items()
101
                         if result.get('status') != 'healthy']
102

103
        if unhealthy_apps:
104
            self.send_alert(f"Applications unhealthy: {', '.join(unhealthy_apps)}")
105

106
        return tunnel_healthy and not unhealthy_apps
107

108
# Configuration file: monitor-config.json
109
config = {
110
    "metrics_port": 8080,
111
    "webhook_url": "https://hooks.slack.com/your-webhook-url",
112
    "applications": [
113
        {
114
            "name": "webapp",
115
            "url": "https://webapp.example.com/health",
116
            "headers": {"User-Agent": "TunnelMonitor/1.0"}
117
        },
118
        {
119
            "name": "api",
120
            "url": "https://api.example.com/status",
121
            "headers": {"Authorization": "Bearer monitoring-token"}
122
        }
123
    ]
124
}
125

126
if __name__ == "__main__":
127
    monitor = TunnelMonitor()
128

129
    while True:
130
        try:
131
            monitor.run_checks()
132
            time.sleep(300)  # Check every 5 minutes
133
        except KeyboardInterrupt:
134
            break
135
        except Exception as e:
136
            logger.error(f"Monitor error: {e}")
137
            time.sleep(60)