This script replaces the manual Cloudflare UI steps (tunnel, service token, One-time PIN IdP, and Access app + policies), writes .env with your tunnel token (and service token credentials when created), and writes an .env.example file.

• Create an API token (Create Token → Create Custom Token) so the setup script has permission to add the required application/policies/tunnel on your Cloudflare account:

  

  Optional: Under Account Resources, Include only the Cloudflare account that manages your domain.

  Optional: Select TTL End Date to be short-lived, e.g. one day in the future (you'll only need this key once for running the setup script).

• Find your Cloudflare Account ID and Zone ID

• Export env vars. Important: Be sure to set at least one of ALLOWED_EMAIL_DOMAIN or ALLOWED_EMAILS (both also works).

  Env var	Description	Example
  CLOUDFLARE_API_TOKEN	API token from the dashboard	...
  CLOUDFLARE_ACCOUNT_ID	Cloudflare account ID	...
  CLOUDFLARE_ZONE_ID	Cloudflare zone ID	...
  APP_DOMAIN	Your domain	mydomain.com
  APP_SUBDOMAIN	Subdomain to create	myservice
  ORIGIN_SERVICE	Internal URL to your service container (service name comes from docker-compose.yml in Step 1)	http://my-service:8000
  TUNNEL_NAME	Tunnel name	my-tunnel
  ACCESS_APP_NAME	Access app name	my-application
  SERVICE_TOKEN_NAME	Service token name	my-service-token
  ALLOWED_EMAIL_DOMAIN	Auth allowlist by email domain	mydomain.com to allow all @mydomain.com users
  ALLOWED_EMAILS	Auth allowlist by specific emails	[email protected],[email protected] to allow specific users
  ACCESS_SESSION_DURATION	Optional session duration for humans	24h
  SERVICE_TOKEN_DURATION	Optional service token duration	8760h
  ENV_FILE_PATH	Optional .env output path (change to avoid overwriting an existing one)	./.env
  ENV_TEMPLATE_PATH	Optional .env.example template output path (change to avoid overwriting an existing one)	./.env.example

  export CLOUDFLARE_API_TOKEN="..."
  export CLOUDFLARE_ACCOUNT_ID="..."
  export CLOUDFLARE_ZONE_ID="..."
  
  export APP_DOMAIN="mydomain.com"
  export APP_SUBDOMAIN="myservice"
  export ORIGIN_SERVICE="http://my-service:8000"
  
  export TUNNEL_NAME="my-tunnel"
  export ACCESS_APP_NAME="my-application"
  export SERVICE_TOKEN_NAME="my-service-token"
  
  export ALLOWED_EMAIL_DOMAIN="mydomain.com"
  export ALLOWED_EMAILS="[email protected],[email protected]"
  
  export ACCESS_SESSION_DURATION="24h"
  export SERVICE_TOKEN_DURATION="8760h"
  
  export ENV_FILE_PATH="./.env"
  export ENV_TEMPLATE_PATH="./.env.example"

• In the same shell, run the script:

  ./scripts/cloudflare-setup.sh

a. Go to Cloudflare Zero Trust, then go to Networks → Connectors → Create a tunnel → Select Cloudflared.

b. Set a Tunnel name, e.g. my-tunnel, and click Save tunnel.

c. Choose your environment (OS), Mac.

d. If you do not already have cloudflared installed (check with which cloudflared), now is a good time to run brew install cloudflared as this screen recommends.

e. Copy one of the code blocks to get the tunnel token. It isn't shown in full on this page, but you can paste the result somewhere, then copy the full token part. Create .env from .env.example:

cp .env.example .env

and paste in the token: CLOUDFLARE_TUNNEL_TOKEN=<token>. Back in Cloudflare, click Next.

f.

• Under Hostname:
  • Set a value for Subdomain, e.g. myservice
  • Select your domain from the Domain dropdown, e.g. <mydomain.com>. Note: Your domain must be on Cloudflare and using Cloudflare DNS (nameservers pointed at Cloudflare), or the subdomain set in this step will not resolve correctly.
• Under Service:
  • Select Type: HTTP
  • Set URL: <service-name>:<port>, e.g. example-api:8000. Use the service name + port you set in Step 1. See example/ for a minimal example setup.
• Click Complete setup

a. While still in Cloudflare Zero Trust, go to Access controls → Service credentials → Create Service Token

b.

• Set a Service token name, e.g. my-service-token
• Select a Service Token Duration: Non-expiring
• Click Generate token
• Copy/save your Client ID and Client Secret (only available once on this screen).
• Update .env with CF_ACCESS_CLIENT_ID=<client id> and CF_ACCESS_CLIENT_SECRET=<client secret>.

While still in Cloudflare Zero Trust, go to Integrations → Identity providers → Add an identity provider → One-time PIN; it should show Added.

a. While still in Cloudflare Zero Trust, go to Access controls → Applications → Add an application → Select Self-hosted

b.

• Under Basic information:
  • Set an Application name, e.g. my-application
  • Select a Session Duration that works for you, e.g. 24 hours. This sets the auth session duration for when visiting myservice.<mydomain.com>, after which you'll need to sign in again.
  • Click Add public hostname, then set values under it:
    • Select Input method: Default
    • Set Subdomain to the same value as before, e.g. myservice
    • Set Domain to the same value as before, e.g. <mydomain.com>
• Under Access policies, we'll create two new policies:
  • Policy 1:
    • Click Create new policy. This will open a new tab.
    • Under Basic Information:
      • Set Policy name: Humans/browser
      • Select Action: Allow
      • Select Session duration: Same as application session timeout
    • Under Add rules → Include (OR):
      • Define who you want to be able to get through the auth guard at your service in the browser. For example, select Selector: Emails, and enter specific emails in Value, or select Selector: Emails ending in with Value: @<mydomain.com>.
    • Click Save and go back to the previous tab
    • Click Select existing policies and choose the policy you just created
  • Policy 2:
    • Click Create new policy. This will open a new tab.
    • Under Basic Information:
      • Set Policy name: Jobs/non-interactive
      • Select Action: Service Auth
      • Select Session duration: No duration, expires immediately
    • Under Add rules → Include (OR):
      • Select Selector: Service Token
      • Select Value as the token name you created earlier, e.g. my-service-token
    • Click Save and go back to the previous tab
    • Click Select existing policies and choose the policy you just created
• Under Login methods:
  • Turn on Accept all available identity providers. You should see One-time PIN availabe in the list below.
• Click Next
• Optional: Under Application Appearance, select Use custom logo and provide link to your website's favicon!
• Under 401 Response for Service Auth policies, turn on Return 401 response. This makes it so unauthenticated API clients get a 401 instead of a login page.
• Click Save