Cloudflare Argo Tunnel for Self Signed Project

Zero Trust Cloudflare Tunnel
1

I have a nextcloud instance locally with self-signed certificate, I tried to use cloudflared argo to access from instance from outside but generated URL never works.
This is my config file:

tunnel: tunnel_id
credentials-file: /home/me/.cloudflared/tunnel_id.json

ingress:
  - hostname: cloud.domain.com
    service: https://localhost:443
    originRequest:
      connectTimeout: 10s
      noTLSverify: true
  - service: http_status:404

I tried no-tls-verify: true as well.

After running it (cloudflared tunnel --config config.yml run) shows no error but the instance still not available from URL even from tunnel_id.cfargotunnel.com.

If I try cloudflared tunnel --url https://localhost:443 --no-tls-verify it works, random_strings.cfargotunnel.com which is generated points to my service, without --no-tls-verify it shows some errors.

Where did I make mistake?

cloudflared version 2021.7.0 (built 2021-07-12-1109 UTC)

2

The only difference between your ingress rules and the one I use for my Nextcloud is the connectTimeout. Mine is 30s.

If you’re talking about the DNS entry, I don’t think mine was generated. I may have manually created the CNAME that points to tunnel_id.cfargotunnel.com

3

I don’t mean DNS entry, without DNS cfargotunnel.com should be accessible anyway.

connectTimeout: 10s makes no difference

Do you have self-signed certificate or let's encrypt one?

4

I have a Cloudflare origin cert, but that doesn’t matter since we’re connecting to “localhost”, which isn’t on the cert. That’s why noTLSVerify is important.

I’m not sure what you mean by this. Your tunnel’s “public” end is tunnel_id.cfargotunnel.com, but proxied.

5

If you find this thread like I did, noTLSverify should have been noTLSVerify.

2 Likes