Cloudflare Tunnel

With Cloudflare Tunnel, a small connector (cloudflared) opens an outbound connection from your server to Cloudflare, and Cloudflare serves your domain over HTTPS through it. No ports to open, no public IP needed: it works at home, behind CGNAT or with an ISP-locked router.

You need a Cloudflare account (the free plan is fine) with your domain managed by Cloudflare (using its DNS servers).

Create the tunnelCopy Anchor Link

In the Cloudflare dashboard, go to Zero Trust and find the tunnels section (under Networks). Create a tunnel of type Cloudflared, give it a name (for example kumoyami) and copy the token shown in the install instructions: it's the long string after --token.

Run cloudflared alongside KumoYamiCopy Anchor Link

The tidiest way is to add cloudflared to the same Docker Compose project, in a docker-compose.override.yml next to docker-compose.yml:

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}
    depends_on:
      - web

Put the token in .env:

CLOUDFLARE_TUNNEL_TOKEN=eyJhIjoi…

And start it:

docker compose up -d

In the Cloudflare dashboard, the tunnel should now show as connected.

Publish your domainCopy Anchor Link

In the tunnel's settings, add a public hostname (Public Hostname):

• Subdomain and domain: for example nube and example.com.
• Service: type HTTP, URL web:3000 (KumoYami's service on the Docker network, on its internal port).

Cloudflare creates the DNS record for you. Open https://nube.example.com/admin.

Worth knowingCopy Anchor Link

• Upload size: Cloudflare caps the size of each request (100 MB on the Free and Pro plans). Uploads or WebDAV copies of larger files may fail through the tunnel.
• If you use the installer: don't give it a domain (or remove its Caddy with --no-caddy): with the tunnel you need neither Caddy nor open ports 80 and 443.
• Video: your content goes through Cloudflare's network. Check their terms of service if you'll be serving a lot of video.