1# Tunnel Patterns
2 
3## Docker Deployment
4 
5### Token-Based (Recommended)
6```yaml
7services:
8  cloudflared:
9    image: cloudflare/cloudflared:latest
10    command: tunnel --no-autoupdate run --token ${TUNNEL_TOKEN}
11    restart: unless-stopped
12```
13 
14### Local Config
15```yaml
16services:
17  cloudflared:
18    image: cloudflare/cloudflared:latest
19    volumes:
20      - ./config.yml:/etc/cloudflared/config.yml:ro
21      - ./credentials.json:/etc/cloudflared/credentials.json:ro
22    command: tunnel run
23```
24 
25## Kubernetes Deployment
26 
27```yaml
28apiVersion: apps/v1
29kind: Deployment
30metadata:
31  name: cloudflared
32spec:
33  replicas: 2
34  selector:
35    matchLabels:
36      app: cloudflared
37  template:
38    metadata:
39      labels:
40        app: cloudflared
41    spec:
42      containers:
43      - name: cloudflared
44        image: cloudflare/cloudflared:latest
45        args:
46        - tunnel
47        - --no-autoupdate
48        - run
49        - --token
50        - $(TUNNEL_TOKEN)
51        env:
52        - name: TUNNEL_TOKEN
53          valueFrom:
54            secretKeyRef:
55              name: tunnel-credentials
56              key: token
57```
58 
59## High Availability
60 
61```yaml
62# Same config on multiple servers
63tunnel: <UUID>
64credentials-file: /path/to/creds.json
65 
66ingress:
67  - hostname: app.example.com
68    service: http://localhost:8000
69  - service: http_status:404
70```
71 
72Run same config on multiple machines. Cloudflare automatically load balances. Long-lived connections (WebSocket, SSH) may drop during updates.
73 
74## Use Cases
75 
76### Web Application
77```yaml
78ingress:
79  - hostname: myapp.example.com
80    service: http://localhost:3000
81  - service: http_status:404
82```
83 
84### SSH Access
85```yaml
86ingress:
87  - hostname: ssh.example.com
88    service: ssh://localhost:22
89  - service: http_status:404
90```
91 
92Client: `cloudflared access ssh --hostname ssh.example.com`
93 
94### gRPC Service
95```yaml
96ingress:
97  - hostname: grpc.example.com
98    service: http://localhost:50051
99    originRequest:
100      http2Origin: true
101  - service: http_status:404
102```
103 
104## Infrastructure as Code
105 
106### Terraform
107 
108```hcl
109resource "random_id" "tunnel_secret" {
110  byte_length = 32
111}
112 
113resource "cloudflare_tunnel" "app" {
114  account_id = var.cloudflare_account_id
115  name       = "app-tunnel"
116  secret     = random_id.tunnel_secret.b64_std
117}
118 
119resource "cloudflare_tunnel_config" "app" {
120  account_id = var.cloudflare_account_id
121  tunnel_id  = cloudflare_tunnel.app.id
122  config {
123    ingress_rule {
124      hostname = "app.example.com"
125      service  = "http://localhost:8000"
126    }
127    ingress_rule { service = "http_status:404" }
128  }
129}
130 
131resource "cloudflare_record" "app" {
132  zone_id = var.cloudflare_zone_id
133  name    = "app"
134  value   = cloudflare_tunnel.app.cname
135  type    = "CNAME"
136  proxied = true
137}
138 
139output "tunnel_token" {
140  value     = cloudflare_tunnel.app.tunnel_token
141  sensitive = true
142}
143```
144 
145### Pulumi
146 
147```typescript
148import * as cloudflare from "@pulumi/cloudflare";
149import * as random from "@pulumi/random";
150 
151const secret = new random.RandomId("secret", { byteLength: 32 });
152 
153const tunnel = new cloudflare.ZeroTrustTunnelCloudflared("tunnel", {
154  accountId: accountId,
155  name: "app-tunnel",
156  secret: secret.b64Std,
157});
158 
159const config = new cloudflare.ZeroTrustTunnelCloudflaredConfig("config", {
160  accountId: accountId,
161  tunnelId: tunnel.id,
162  config: {
163    ingressRules: [
164      { hostname: "app.example.com", service: "http://localhost:8000" },
165      { service: "http_status:404" },
166    ],
167  },
168});
169 
170new cloudflare.Record("dns", {
171  zoneId: zoneId,
172  name: "app",
173  value: tunnel.cname,
174  type: "CNAME",
175  proxied: true,
176});
177```
178 
179## Service Installation
180 
181### Linux systemd
182```bash
183cloudflared service install
184systemctl start cloudflared && systemctl enable cloudflared
185journalctl -u cloudflared -f  # Logs
186```
187 
188### macOS launchd
189```bash
190sudo cloudflared service install
191sudo launchctl start com.cloudflare.cloudflared
192```
193