WIUNIX ACADEMY
Set up Cloudflare Tunnel and Access for a private web app on Ubuntu and Debian
Page 5 of 5. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment8 editable values
LET’S BUILD
Retain recovery inputs without leaking the token
Before changing the working setup, record the tunnel ID/name, exact hostname/route, Access application/AUD, identity policy, DNS and installed package version in your protected operations record. Keep the connector token only in an approved encrypted secret store; it is excluded from the following backup. On a fresh /var/backups/academy-tunnel, copy both non-secret units and marker with original absolute paths. Keep this directory root-only and retain it outside the web root. Store a separate protected copy off-host. This is configuration recovery, not a Cloudflare account export or an application-data backup.
Run at the location stated in this step
sudo install -d -m 0700 '/var/backups/academy-tunnel'
sudo cp --parents --preserve=mode,timestamps /etc/systemd/system/academy-origin.service /etc/systemd/system/cloudflared-academy.service '/srv/academy-origin/health.txt' '/var/backups/academy-tunnel/'
sudo cmp /etc/systemd/system/academy-origin.service '/var/backups/academy-tunnel/etc/systemd/system/academy-origin.service'
sudo cmp /etc/systemd/system/cloudflared-academy.service '/var/backups/academy-tunnel/etc/systemd/system/cloudflared-academy.service'
sudo cmp '/srv/academy-origin/health.txt' '/var/backups/academy-tunnel/srv/academy-origin/health.txt'
cloudflared --version
All three comparisons match; encrypted credential recovery and dashboard policy records are available separately.
LET’S BUILD
Restore deliberately with the route closed
For a failed change to this dedicated setup only, remove its published route in the dashboard first, keeping Access. Stop the connector, inspect the selected backup, then restore these known non-secret files. The unit below retains the selected original paths; recreate missing parent directories. Restore the token through the earlier protected editor from your approved vault; if compromised, use a newly rotated token instead. Verify local receiver/connector before recreating the identical protected route and repeating allowed/denied tests. Do not restore stale policy or overwrite another workload.
Run at the location stated in this step
sudo systemctl stop cloudflared-academy.service
sudo install -d -m 0755 '/srv/academy-origin'
sudo install -d -m 0755 "$(dirname '/srv/academy-origin/health.txt')"
sudo install -m 0644 '/var/backups/academy-tunnel/etc/systemd/system/academy-origin.service' /etc/systemd/system/academy-origin.service
sudo install -m 0644 '/var/backups/academy-tunnel/etc/systemd/system/cloudflared-academy.service' /etc/systemd/system/cloudflared-academy.service
sudo install -m 0644 '/var/backups/academy-tunnel/srv/academy-origin/health.txt' '/srv/academy-origin/health.txt'
sudo systemd-analyze verify /etc/systemd/system/academy-origin.service /etc/systemd/system/cloudflared-academy.service
sudo systemctl daemon-reload
sudo systemctl restart academy-origin.service
curl --fail --silent --show-error --noproxy '*' http://127.0.0.1:8080/health.txt
Local marker works with route still absent. Restore a valid token, start the connector and repeat security acceptance before reopening.
LET’S BUILD
Rotate and respond to compromise
A tunnel token is a bearer credential: anyone holding it can join a connector. For routine rotation use the tunnel’s Rotate token action, replace the protected file through the earlier editor, then restart this dedicated unit; systemd reloads credentials on restart. Existing connectors may stay connected after token rotation. For compromise, close the route, rotate immediately and use Cloudflare’s documented force-disconnect procedure through your approved incident process; do not assume rotation evicts a stolen active connector. Update every authorized replica, revoke affected Access sessions separately if necessary, and repeat denial/receiver tests. Never put an account API token in these examples.
Run at the location stated in this step
sudo systemctl restart cloudflared-academy.service
sudo systemctl is-active cloudflared-academy.service
Authorized connector uses the replacement credential; incident acceptance includes disconnected untrusted replicas and repeated Access tests.
LET’S BUILD
Update through APT in a maintenance window
Review current release notes, security advisories and installed/candidate versions first. Retain recovery inputs and close the route if confidentiality is uncertain. Update only this package in a maintenance window; a single-connector restart interrupts traffic. Recheck token-file support, unit health, actual receiver and denied identities. This guide does not promise a particular future package version or zero downtime. A rollback needs a reviewed available signed package and its security implications; do not downgrade blindly.
Run at the location stated in this step
apt-cache policy cloudflared
cloudflared --version
sudo apt-get update
sudo apt-get install --only-upgrade cloudflared
sudo systemctl restart cloudflared-academy.service
Reviewed maintained package installed; receiver and negative authorization tests repeated successfully.
LET’S BUILD
Withdraw the demo safely
Remove only this published route and its associated tunnel DNS record in Cloudflare; verify the marker is no longer reachable. Keep Access until no route/alias can reach the host. Disable only the two dedicated units below, retaining files/token/backup under your retention policy. No package purge, user deletion or shared firewall reset is needed. Do not repoint DNS at the origin IP. Deleting an Access app first can expose a still-running route. For permanent retirement revoke the tunnel token/delete the now-unused tunnel through your approved account process after confirming it has no other routes or replicas.
Run at the location stated in this step
sudo systemctl disable --now cloudflared-academy.service academy-origin.service
sudo systemctl is-active cloudflared-academy.service academy-origin.service
Both dedicated services inactive; no public route or DNS alias reaches the marker; recovery files retained.
Replace the marker only after acceptance
For a real application retain origin isolation, application authorization, secure cookies/redirects, auditable Access policies and tested backup/restore. Design HTTPS for a remote origin, capacity, multiple failure domains and protected probes separately. Do not reuse the demo Python server for production. The related WireGuard guide covers routed site-to-site networking; Tunnel plus Access solves a different, application-specific access problem.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.
- Cloudflare Tunnel setup
- Access self-hosted application
- Official signed APT repository
- Runtime token-file parameters
- Origin TLS and Access validation
- Tunnel tokens and rotation
- Outbound firewall destinations
- Troubleshooting
- HTTPS origin troubleshooting
- systemd credentials
- Ubuntu 26.10 release images
- Ubuntu release coverage
- Debian stable release
- Debian LTS coverage
KEEP LEARNING