# Cloudflare Tunnel Back to [[Obsidian/Self-Hosting with Quartz/Self-Hosting with Quartz|Self-Hosting with Quartz]]. A tunnel is an **outbound** connection from the `cloudflared` container on the NAS to Cloudflare. Visitors connect to Cloudflare, which forwards their requests down the tunnel. You don't need a static IP or port forwarding, it works behind CGNAT, and Cloudflare issues and renews the HTTPS certificate. ## Prerequisite: the domain must be on Cloudflare DNS - A tunnel hostname can only be created in a zone that's **active in your Cloudflare account**, so the domain's nameservers must be Cloudflare's. - Status as of 2026-10-22, from public lookups: - `jmarshallpittman.net`: Cloudflare nameservers (`david` / `jule.ns.cloudflare.com`). ✅ - `jmarshallpittman.org`: Cloudflare nameservers. ✅ - `jmarshallpittman.com`: **Vercel DNS** (`ns1` / `ns2.vercel-dns.com`). ❌ To use the tunnel here (for example `cv.jmarshallpittman.com`), first add the zone to Cloudflare. Then re-create the Vercel and Digital Garden records there, and change the nameservers at your registrar. - Confirm in the dashboard that `.net` and `.org` are in *your* account. ## Steps 1. Log in at https://dash.cloudflare.com and go to **Networking > Tunnels > Create a tunnel**. 2. Name it `synology-web` and select **Create Tunnel**. 3. For the environment, choose **Docker**. Cloudflare shows a command containing `--token <long string>`. **Copy only the token** into the `.env` file of the Container Manager project as `TUNNEL_TOKEN=...` (see [[Obsidian/Self-Hosting with Quartz/Synology Web Hosting|Synology Web Hosting]], section 5a). 4. Start the project in Container Manager. Back in the dashboard, wait for the connector to appear, then select **Continue**. 5. **Routes > Add route > Published application:** - Subdomain: `notes`. Domain: `jmarshallpittman.org`. - Service URL: `http://localhost:8180`, or `http://<NAS-LAN-IP>:8180`. That's the port-based Web Station portal. - Select **Add route**. Cloudflare creates the DNS record for you. 6. The tunnel should show **Healthy** under Networking > Tunnels. 7. Test `https://notes.jmarshallpittman.org` from a phone on cellular. Notes: - Use one subdomain level, such as `notes.` or `videos.`. Deeper hostnames like `a.b.domain` need a paid Advanced Certificate. - One tunnel can serve several hostnames. Add one route per site later, for videos or the CV. - If you ever want the site private, put a Cloudflare Access policy in front of it. ## Recommended zone settings - **SSL/TLS > Edge Certificates:** turn on **Always Use HTTPS**. - Leave the cache at its defaults. Cloudflare caches images, CSS and JS, but not HTML, so each deploy shows up immediately. Quartz fingerprints its CSS and JS files. - After a big redesign, use **Caching > Purge Everything** if old assets linger. ## Sources - Create a tunnel (dashboard): https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/ - Cloudflare Tunnel overview: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/