Technology · Platform

Cloudflare Tunnel

Tunnelled ingress means my estate has no open inbound ports.

Auth and access plane · Helix · FAFOHiveMutual TLS insideCloudflare Access
Exposure split by purpose
Main estatethe memory gateway
Helixpresence and media, behind Access
Social bridgesin-house platform modules
Webhook intakecut alone, estate untouched
0inbound ports open

Every public surface, from the memory gateway to the Teams bridge, arrives through an authenticated tunnel.

Outbound tunnels, one per purpose

Auth and access plane lets outside services reach parts of my estate.

I chose outbound-only Cloudflare tunnels and split them by purpose, so webhook intake and the social bridges can be shut without touching the main estate.

Edge Workeronly where a vendor needs a public surface
Outbound tunnel, one per purpose
NGINXHSTS, modern TLS, headers, rate-limit zones
Service on loopback
Each layer narrows what reaches the next. Operator and host-to-host traffic never takes this path; it rides a private mesh.

A route behind Access, tested from both sides

Helix has to accept Teams media from Microsoft's side and stay closed to everyone else. I published its presence and media endpoint through a tunnel route behind Cloudflare Access, and when the voice services moved to another host, I re-pointed the route and tested it from both sides.

internetAccesstunnelhost firewallservice
Authorised health check200
Anonymous request403
Direct, untrusted sourcedropped
A route counts as protected only when the anonymous request fails and the authorised one succeeds.

I check access control by trying to get in.

Inside the estate, Helix services authenticate each other with mutual TLS and client certificates, so service identity comes from the transport and no bearer token sits in a configuration file.

Replacing a proxied DNS entry with a route

FAFOHive serves its in-house social-platform modules through a tunnel the social bridges share. The first pattern I was handed was a proxied DNS entry pointing at the host's public address, and the no-inbound design refused it.

Proxied DNS to the public address
522
Tunnel route, NGINX as origin
reached
The 522 was the no-inbound design doing its job; the fix was the route, under a Cloudflare origin certificate, not an open port.

Webhook intake for the governed third-party gateway arrives through its own tunnel, and those events are signature-checked and stored before they are acknowledged.

The work is configuration and operation of Cloudflare's product around services I built.