Cloudflare Tunnel
Reach the panel through Cloudflare when its server cannot accept connections from the internet.
Settings -> Deplo -> Advanced -> Panel access, instance admins only.
Use it when the server running Deplo sits behind a home or office router, or on a connection where port 443 cannot be opened. A small connector next to the panel dials out to Cloudflare, and Cloudflare serves the panel's address over that connection, HTTPS certificate included.
You need:
- A domain on your Cloudflare account, like
example.com. - A Cloudflare API token with these permissions:
| Type | Item | Permission |
|---|---|---|
| Account | Cloudflare Tunnel | Edit |
| Zone | DNS | Edit |
| Zone | Zone | Read |
Deplo does the rest: it creates the tunnel, its routes and the DNS record, starts the connector, checks that the address answers, then moves the panel.
Turn it on
Create the token
In Cloudflare, My Profile -> API Tokens -> Create Token -> Custom token. The Create one link in Deplo opens this form with the DNS and Zone permissions filled in: add Account -> Cloudflare Tunnel -> Edit, then create it.
Open the setting
Settings -> Deplo -> Advanced, turn on Cloudflare Tunnel.
Enter the address and the token
For example deplo.example.com. Continue shows what the move affects
(passkeys, sessions, deploy hooks), like any change of the panel address.
Confirm
It usually takes under a minute. If the address does not answer through the tunnel, Deplo undoes every step, in Cloudflare too, and the panel stays where it was.
What Deplo creates
| Where | What |
|---|---|
| Cloudflare | A tunnel named like deplo-deplo.example.com-3f9a1c |
| Cloudflare | Its routes: deplo.example.com/api/agent/link for your servers, deplo.example.com for the panel |
| Cloudflare | A proxied CNAME record deplo.example.com -> <tunnel id>.cfargotunnel.com |
| Your server | A deplo-tunnel container next to the panel's proxy |
Deplo touches no other DNS record. If the address already has a record that points somewhere else, it refuses and names that record. A record that points at this server, like the panel's own domain, is replaced.
Your other servers
Servers you add connect to the panel through the tunnel too, so nothing has to be opened on them either. The backup address stays as it is.
While it is on
- The panel address on the General tab is read-only. Change it with Cloudflare Tunnel -> Change address: Deplo keeps the tunnel and moves its DNS record.
- The HTTPS switch is locked. Cloudflare serves the certificate.
- The status is live. Connected comes straight from Cloudflare. Not connected means the server cannot reach Cloudflare: check that it can reach the internet.
- The token stays encrypted and is never shown again. To replace it, use Change address with the same address and the new token.
- Updates keep the tunnel.
Turn it off
Turn off Cloudflare Tunnel. Deplo moves the panel to its backup address, or to an address you type, checks that it answers, removes the connector, then deletes the tunnel and its DNS record in Cloudflare.
If Cloudflare refuses the deletion, for example because the token was revoked, the panel still moves and Deplo tells you what is left to delete by hand.
Behind a router, the backup address may not answer
If the internet cannot reach the server, the new address cannot answer either. Turning the tunnel off then fails safely: the panel stays on the tunnel.
If the tunnel breaks
On the server running Deplo:
# Move the panel to the generated address, then restart so Deplo makes the move
deplo recover panel-address -
deplo restartAs it starts, Deplo moves the panel, removes the connector and deletes the tunnel and its DNS record in Cloudflare. If the saved token no longer works, Activity says what is left to delete under Zero Trust -> Networks -> Tunnels. See Break-glass recovery.
Next steps
Did this page help you?