spb/tools-spboucher-ai

1{2  "slug": "cloudflare-tunnel",3  "name": "Cloudflare Tunnel",4  "aliases": ["cloudflared", "Argo Tunnel"],5  "vendor": { "name": "Cloudflare, Inc.", "slug": "cloudflare-inc", "website": "https://www.cloudflare.com" },6  "homepage_url": "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/",7  "docs_url": "https://developers.cloudflare.com/cloudflare-one/",8  "repo_url": "https://github.com/cloudflare/cloudflared",9  "pricing_url": "https://www.cloudflare.com/plans/",10  "license_url": "https://github.com/cloudflare/cloudflared/blob/master/LICENSE",11  "product_type": "service",12  "product_status": "active",13  "summary": "Outbound-only connector (cloudflared) that publishes local web services and private networks through Cloudflare's edge without opening inbound ports",14  "description": "Cloudflare Tunnel is the connector component of Cloudflare One, formerly sold as Argo Tunnel. A daemon called cloudflared, open source under Apache-2.0, runs next to the service to be published and opens persistent outbound connections to several Cloudflare data centers. Requests for a hostname in a Cloudflare-managed DNS zone are routed through those connections to the local origin, so the server needs no public IP address, port forwarding or certificate of its own: TLS terminates at Cloudflare's edge and the hop to the origin is carried inside the tunnel.\n\nA named tunnel is created once, receives a UUID and credentials, and can carry many hostnames through an ingress list that maps each to a local URL; the same tunnel can also expose private IP ranges to users running the WARP client, which turns it into a Zero Trust replacement for a VPN. Cloudflare Access policies can sit in front of any published hostname to require identity-provider login. Quick tunnels provide a random trycloudflare.com URL for one-off sharing without an account. cloudflared runs as a service on Linux, macOS and Windows and as a container.\n\nIt is the usual way to publish services from a home network, a laptop or machines behind carrier-grade NAT, and is widely used alongside self-hosted dashboards and APIs. Constraints: the domain must use Cloudflare DNS, all public traffic transits Cloudflare and is decrypted there, non-HTTP protocols require WARP or `cloudflared access` on the client side, and the free tier is subject to Cloudflare's terms for non-HTML content and usage.",15  "capabilities": ["Publish local HTTP services under a Cloudflare-managed hostname with no inbound ports", "Named tunnels with ingress rules mapping many hostnames to local origins", "Private network routing to WARP clients for VPN-style access", "Cloudflare Access policies in front of published applications", "Quick tunnels with a temporary public URL for ad hoc sharing", "Runs as a system service, container or Kubernetes deployment"],16  "workflows": ["Expose a self-hosted web app from a home server or Mac mini", "Protect an internal dashboard behind single sign-on with Access", "Give remote staff access to a private subnet through WARP", "Share a local development server temporarily"],17  "advantages": ["No open firewall ports, static IP or certificate management on the origin", "Open-source connector with multi-region redundancy", "Integrates with Cloudflare's WAF, caching and Zero Trust policies", "Usable at no cost for typical personal deployments"],18  "limitations": ["Requires the domain's DNS to be hosted at Cloudflare", "TLS is terminated at Cloudflare; traffic is visible to the provider", "Non-HTTP protocols need client-side software (WARP or cloudflared access)", "Subject to Cloudflare terms and plan limits"],19  "prerequisites": ["Cloudflare account with a domain on Cloudflare DNS", "cloudflared installed on a host that can reach the service"],20  "audiences": ["Self-hosters and homelab operators", "Teams replacing a VPN with Zero Trust access", "Developers sharing local services"],21  "alternatives": ["ngrok", "tailscale", "wireguard", "caddy"],22  "comparison_notes": "ngrok offers the same outbound model as a standalone product with its own domains and a closed-source agent; Cloudflare Tunnel is tied to a Cloudflare DNS zone but the connector is open source. Tailscale builds a private mesh first and exposes services publicly only through Funnel. A self-managed WireGuard link to a VPS running Caddy reproduces the architecture under the operator's control, keeping TLS termination out of a third party's hands at the cost of running the gateway.",23  "categories": [{ "slug": "tunneling-remote-access", "primary": true }],24  "tags": ["tunnel", "zero-trust", "reverse-proxy", "open-source", "cli", "cloudflare"],25  "use_cases": ["expose-local-services", "host-web-apps", "access-remote-machines"],26  "operating_systems": ["linux", "macos", "windows"],27  "execution_modes": ["cloud", "local"],28  "interfaces": ["cli", "web", "api"],29  "deployment_models": ["saas", "hybrid"],30  "integrations": ["Cloudflare DNS", "Cloudflare Access", "WARP", "Docker", "Kubernetes", "Terraform"],31  "data_formats": ["YAML tunnel configuration", "JSON credentials"],32  "languages": ["Go"],33  "source_model": "mixed",34  "license_spdx": "Apache-2.0",35  "pricing_model": ["freemium", "paid", "enterprise"],36  "pricing_checked_at": "2026-11-02",37  "self_hostable": false,38  "sources": [39    { "url": "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/", "type": "official_docs", "title": "Cloudflare Tunnel · Cloudflare One docs", "supports": ["name", "summary", "capabilities", "description"], "checked_at": "2026-11-02" },40    { "url": "https://www.cloudflare.com/", "type": "official_site", "title": "Cloudflare", "supports": ["vendor"], "checked_at": "2026-11-02" },41    { "url": "https://github.com/cloudflare/cloudflared/blob/master/LICENSE", "type": "license_page", "title": "cloudflared LICENSE (Apache-2.0)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" },42    { "url": "https://www.cloudflare.com/plans/", "type": "pricing_page", "title": "Cloudflare Plans", "supports": ["pricing_model"], "checked_at": "2026-11-02" }43  ],44  "confidence": "high",45  "uncertainty_note": "license_spdx covers the cloudflared connector; the edge service is proprietary.",46  "discovery_method": "editorial-research",47  "depth": "deep",48  "editorial_status": "reviewed",49  "visibility": "public",50  "featured": false,51  "author": "batch-B2"52}53