Cloudflare Tunnel : exposer ses services sans ouvrir de ports

[User] → [Cloudflare Edge] ← encrypted tunnel ← [cloudflared on your VPS] → [localhost:8000]

# Add Cloudflare's official repository
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list

sudo apt update && sudo apt install -y cloudflared

cloudflared --version
# cloudflared version 2025.x.x (built ...)

# If the repository causes issues
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared
sudo chmod +x /usr/local/bin/cloudflared

cloudflared tunnel login

# Verify the certificate exists
ls -la ~/.cloudflared/cert.pem

# Create a named tunnel
cloudflared tunnel create my-tunnel

# Expected output:
# Tunnel credentials written to /root/.cloudflared/<UUID>.json
# Created tunnel my-tunnel with id <UUID>

cloudflared tunnel list

# ID                                   NAME        CREATED
# a1b2c3d4-e5f6-7890-abcd-ef1234567890 my-tunnel  2026-02-24T10:00:00Z

nano ~/.cloudflared/config.yml

tunnel: a1b2c3d4-e5f6-7890-abcd-ef1234567890
credentials-file: /root/.cloudflared/a1b2c3d4-e5f6-7890-abcd-ef1234567890.json

ingress:
  - hostname: api.mydomain.com
    service: http://localhost:8000
  - service: http_status:404

tunnel: a1b2c3d4-e5f6-7890-abcd-ef1234567890
credentials-file: /root/.cloudflared/a1b2c3d4-e5f6-7890-abcd-ef1234567890.json

ingress:
  # FastAPI API
  - hostname: api.mydomain.com
    service: http://localhost:8000
    originRequest:
      connectTimeout: 10s
      noTLSVerify: true

  # Admin dashboard
  - hostname: admin.mydomain.com
    service: http://localhost:3000
    originRequest:
      connectTimeout: 10s

  # Webhook receiver
  - hostname: webhook.mydomain.com
    service: http://localhost:5000

  # Catch-all (required, must be last)
  - service: http_status:404

cloudflared tunnel ingress validate
# OK

# Automatic method (recommended)
cloudflared tunnel route dns my-tunnel api.mydomain.com
cloudflared tunnel route dns my-tunnel admin.mydomain.com
cloudflared tunnel route dns my-tunnel webhook.mydomain.com

cloudflared tunnel run my-tunnel

2026-02-24T10:30:00Z INF Starting tunnel tunnelID=a1b2c3d4-...
2026-02-24T10:30:00Z INF Connection registered connIndex=0 ...
2026-02-24T10:30:00Z INF Connection registered connIndex=1 ...
2026-02-24T10:30:01Z INF Connection registered connIndex=2 ...
2026-02-24T10:30:01Z INF Connection registered connIndex=3 ...

# Install the service
sudo cloudflared service install

# Verify
sudo systemctl status cloudflared

# The service uses the config in /etc/cloudflared/config.yml
# Copy your config if needed:
sudo cp ~/.cloudflared/config.yml /etc/cloudflared/config.yml
sudo cp ~/.cloudflared/*.json /etc/cloudflared/

# Restart
sudo systemctl restart cloudflared
sudo systemctl enable cloudflared

sudo systemctl is-enabled cloudflared
# enabled

# api.py
from fastapi import FastAPI
from pydantic import BaseModel

app = FastAPI(title="My AI API")

class Query(BaseModel):
    prompt: str
    max_tokens: int = 500

@app.get("/health")
def health():
    return {"status": "ok", "version": "1.0.0"}

@app.post("/generate")
async def generate(query: Query):
    # Your AI logic here
    return {
        "response": f"Generated response for: {query.prompt}",
        "tokens_used": 42
    }

uvicorn api:app --host 127.0.0.1 --port 8000

ingress:
  - hostname: api.mydomain.com
    service: http://localhost:8000
    originRequest:
      connectTimeout: 30s  # Longer for AI requests
  - service: http_status:404

# Test from anywhere
curl https://api.mydomain.com/health
# {"status":"ok","version":"1.0.0"}

curl -X POST https://api.mydomain.com/generate \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Hello AI", "max_tokens": 100}'

# config.yml - the dashboard is on localhost:8501 (Streamlit)
ingress:
  - hostname: admin.mydomain.com
    service: http://localhost:8501
    originRequest:
      noTLSVerify: true
  - service: http_status:404

from fastapi import Request, HTTPException
import jwt
import requests

CLOUDFLARE_TEAM = "your-team"
CERTS_URL = f"https://{CLOUDFLARE_TEAM}.cloudflareaccess.com/cdn-cgi/access/certs"

def verify_cloudflare_token(request: Request):
    token = request.headers.get("Cf-Access-Jwt-Assertion")
    if not token:
        raise HTTPException(status_code=403, detail="No access token")

    # Get public keys
    certs = requests.get(CERTS_URL).json()
    public_keys = certs["public_certs"]

    for key_data in public_keys:
        try:
            decoded = jwt.decode(
                token,
                key=jwt.algorithms.RSAAlgorithm.from_jwk(key_data["cert"]),
                algorithms=["RS256"],
                audience=f"https://admin.mydomain.com"
            )
            return decoded
        except jwt.InvalidTokenError:
            continue

    raise HTTPException(status_code=403, detail="Invalid token")

# webhook.py
from fastapi import FastAPI, Request
import hmac
import hashlib

app = FastAPI()
WEBHOOK_SECRET = "your_secret_here"

@app.post("/github")
async def github_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get("X-Hub-Signature-256", "")

    # Verify signature
    expected = "sha256=" + hmac.new(
        WEBHOOK_SECRET.encode(),
        body,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=401, detail="Invalid signature")

    # Process webhook
    return {"status": "ok"}