| name | cloudflared-tunnel-ops |
| description | Use when setting up, debugging, or operating Cloudflare cloudflared tunnels, public hostnames, WebSocket apps, Zero Trust Access gates, DNS routes, and localhost-only origins on VPS or server hosts. |
| stages | ["plan","build","ship","monitor","debug"] |
| benefits-from | ["openclaw-vps-ops","deploy-checklist","debug-investigator"] |
Cloudflared Tunnel Ops
Set up and operate Cloudflare Tunnel (cloudflared) for apps that should be reachable on clean HTTPS/WSS hostnames without opening inbound VPS ports.
Variables
- HOSTNAME: public hostname to expose, for example
craftagents.example.com
- ORIGIN_URL: local origin service, usually
http://127.0.0.1:<port>
- TUNNEL_NAME: stable tunnel name, for example
craft-agents
- ALLOWED_EMAIL: Cloudflare Access allowlisted user email
- CONFIG_PATH:
/etc/cloudflared/config.yml
How It Works
Use named Cloudflare Tunnels for durable production-ish endpoints. Keep the app origin bound to loopback, route a public hostname to the tunnel, put Cloudflare Access in front of the hostname when it protects a sensitive UI, and verify both the Cloudflare edge path and the local socket surface.
Commands
| Command | Purpose |
|---|
/cloudflared-tunnel-ops install | Install cloudflared and complete browser login. |
/cloudflared-tunnel-ops publish | Create a named tunnel, DNS route, service config, and systemd service. |
/cloudflared-tunnel-ops access | Add the matching Cloudflare Access app/policy through the dashboard. |
/cloudflared-tunnel-ops verify | Verify tunnel health, hostname behavior, WebSocket URL config, and local-only exposure. |
/cloudflared-tunnel-ops troubleshoot | Diagnose common tunnel, DNS, Access, and WebSocket failures. |
Cookbook
Each operation has a detailed procedure. Read the relevant cookbook before acting.
When a user invokes a /cloudflared-tunnel-ops command, read the matching cookbook file first, then execute it.
Guardrails
- Do not print tunnel credential JSON, origin certs, API tokens, Access service tokens, app tokens, or user app passwords.
- Prefer named tunnels plus systemd over quick tunnels for durable hostnames.
- Prefer Cloudflare Tunnel over opening inbound firewall ports.
- Keep origins bound to
127.0.0.1 unless the user explicitly chooses a broader bind.
- Treat Cloudflare Access as a dashboard/API configuration step;
cloudflared tunnel login can create tunnels/routes but does not create Access applications or policies by itself.
Related Skills
Works with: /openclaw-vps-ops, /deploy-checklist, /debug-investigator
