Exposing Home Services Securely with Cloudflare Tunnels

What We’re Building

A secure tunnel from Cloudflare to your home server, allowing you to access services like Nginx, n8n, or any web app via your own domain-without port forwarding or exposing your IP address.

Prerequisites

• A Cloudflare account with a domain
• Linux server (Ubuntu/Debian)
• Services you want to expose

The Approach

1. Install cloudflared
2. Authenticate with Cloudflare
3. Create and configure a tunnel
4. Route DNS to your tunnel
5. Run as a system service

Step 1: Install cloudflared

sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared jammy main' | sudo tee /etc/apt/sources.list.d/cloudflared.list

sudo apt-get update && sudo apt-get install cloudflared

Step 2: Authenticate

cloudflared login

This opens a browser to authorise with your Cloudflare account.

Step 3: Create a Tunnel

cloudflared tunnel create my-homelab

Note the tunnel ID-you’ll need it for configuration.

Step 4: Configure the Tunnel

Create /home/username/.cloudflared/config.yml:

tunnel: <tunnel-id>
credentials-file: /home/username/.cloudflared/<tunnel-id>.json

ingress:
  - hostname: nginx.yourdomain.com
    service: http://192.168.1.100:80

  - hostname: n8n.yourdomain.com
    service: http://192.168.1.100:5678

  - service: http_status:404

The catch-all http_status:404 is required.

Step 5: Route DNS

For a wildcard subdomain:

cloudflared tunnel route dns my-homelab *.yourdomain.com

Or create specific CNAME records in Cloudflare pointing to <tunnel-id>.cfargotunnel.com.

Step 6: Run as a Service

Move config to the system location:

sudo mv ~/.cloudflared/config.yml /usr/local/etc/cloudflared/
sudo cloudflared service install
sudo service cloudflared start

Check status:

sudo service cloudflared status

The Result

• Access your home services from anywhere via https://service.yourdomain.com
• No port forwarding required
• Your home IP stays hidden
• Free Cloudflare SSL/TLS

What I’d Do Differently

Use a wildcard DNS route from the start. Managing individual CNAME records for each service becomes tedious quickly.

This took me about an hour to get fully working. If it helped you, let me know on Twitter/Bluesky.