cloudflared-tunnel-ops

name	cloudflared-tunnel-ops
description	Use when setting up, debugging, or operating Cloudflare cloudflared tunnels, public hostnames, WebSocket apps, Zero Trust Access gates, DNS routes, and localhost-only origins on VPS or server hosts.
stages	["plan","build","ship","monitor","debug"]
benefits-from	["openclaw-vps-ops","deploy-checklist","debug-investigator"]

Cloudflared Tunnel Ops

Set up and operate Cloudflare Tunnel (cloudflared) for apps that should be reachable on clean HTTPS/WSS hostnames without opening inbound VPS ports.

Variables

• HOSTNAME: public hostname to expose, for example craftagents.example.com
• ORIGIN_URL: local origin service, usually http://127.0.0.1:<port>
• TUNNEL_NAME: stable tunnel name, for example craft-agents
• ALLOWED_EMAIL: Cloudflare Access allowlisted user email
• CONFIG_PATH: /etc/cloudflared/config.yml

How It Works

Use named Cloudflare Tunnels for durable production-ish endpoints. Keep the app origin bound to loopback, route a public hostname to the tunnel, put Cloudflare Access in front of the hostname when it protects a sensitive UI, and verify both the Cloudflare edge path and the local socket surface.

Commands

Command	Purpose
/cloudflared-tunnel-ops install	Install cloudflared and complete browser login.
/cloudflared-tunnel-ops publish	Create a named tunnel, DNS route, service config, and systemd service.
/cloudflared-tunnel-ops access	Add the matching Cloudflare Access app/policy through the dashboard.
/cloudflared-tunnel-ops verify	Verify tunnel health, hostname behavior, WebSocket URL config, and local-only exposure.
/cloudflared-tunnel-ops troubleshoot	Diagnose common tunnel, DNS, Access, and WebSocket failures.

Cookbook

Each operation has a detailed procedure. Read the relevant cookbook before acting.

Command	Cookbook	Use When
install	cookbook/install.md	cloudflared is missing or not authenticated.
publish	cookbook/publish.md	A localhost service needs a public HTTPS/WSS hostname.
access	cookbook/access.md	A sensitive web UI needs an outer Cloudflare Access gate.
verify	cookbook/verify.md	Confirm the tunnel works and the origin is not public.
troubleshoot	cookbook/troubleshoot.md	Debug 403s, 502s, DNS issues, or insecure WebSocket errors.

When a user invokes a /cloudflared-tunnel-ops command, read the matching cookbook file first, then execute it.

Guardrails

• Do not print tunnel credential JSON, origin certs, API tokens, Access service tokens, app tokens, or user app passwords.
• Prefer named tunnels plus systemd over quick tunnels for durable hostnames.
• Prefer Cloudflare Tunnel over opening inbound firewall ports.
• Keep origins bound to 127.0.0.1 unless the user explicitly chooses a broader bind.
• Treat Cloudflare Access as a dashboard/API configuration step; cloudflared tunnel login can create tunnels/routes but does not create Access applications or policies by itself.

Related Skills

Works with: /openclaw-vps-ops, /deploy-checklist, /debug-investigator