Cloudflare Tunnel

A tunnel reaches a board from anywhere without opening a port. It needs a domain you control on Cloudflare, and cloudflared on your PATH.

Create the tunnel once

$ cloudflared tunnel login
$ cloudflared tunnel create my-board
$ cloudflared tunnel route dns my-board board.example.com

login opens a browser to pick your zone. create writes a credentials JSON under ~/.cloudflared/ and prints the tunnel id. route dns adds the CNAME that points your hostname at the tunnel.

Point the tunnel at the board

Write this to ~/.cloudflared/frizz.yml, which Frizz looks for by name. Keep it out of config.yml, whose catch-all shadows other tunnels:

tunnel: my-board
credentials-file: /Users/you/.cloudflared/<tunnel-id>.json

ingress:
  - hostname: board.example.com
    service: http://127.0.0.1:9393
  - service: http_status:404

Let Frizz own the tunnel

Run the two halves yourself, or hand the tunnel to Frizz as a child process:

  press R, choose Cloudflare Tunnel

  Hostname  board.example.com
  Tunnel    my-board

Frizz asks which tunnel serves the hostname rather than guessing from its first label — a tunnel is rarely named after its host. Both answers are remembered, and it checks that cloudflared is on this machine before accepting them.

Running it under Frizz is worth preferring, because the two halves then share a lifetime. A tunnel that outlives its board serves Cloudflare error 1033 to anyone who visits; a board that outlives its tunnel is unreachable with nothing to say why.