Cloudflare Tunnel Zero Trust (cloudflared) for Self‑Hosted Apps + Free HTTPS
Table of Contents – Cloudflare Tunnel Zero Trust
Overview
Expose self-hosted apps safely without opening inbound ports. Cloudflare Tunnel creates an outbound-only connection from your host to Cloudflare Edge, gives you free HTTPS, and lets you gate access with Zero Trust (SSO/MFA).
External reference:
Cloudflare Tunnel Docs
Prerequisites
- A domain on Cloudflare (free plan works).
- One Linux host that runs the origin app (e.g.,
localhost:8080). - sudo access and a browser for initial login.
Placeholders: app.example.com, my-tunnel, <TUNNEL-UUID>.
Quick Architecture


