Cloudflared Tunnel - multiple services (domains), different accounts for authentication, the same origin/server?

[fritex]

I wonder, is it possible to run multiple cloudflared tunnels on the same origin host / server, but with the situation where for example, Cloudflare authorized/authenticated account “ABC” is added as “administrator/member” under the CF account “DEF”.

The same server.
CF account “ABC” has most zones - no problem adding the services to the tunnel.
CF account “DEF” has got two ones - which would be also nice to run services and add to the existing tunnel?

Possible using only one cloudflared?

Should we use only one account, or how to untangle the thing of “authentication” (not having two CF accounts in “login” through the SSH terminal) as only one CF account “ABC” and make sure the two zones from “DEF” are working alongside all the other tunnels “zones” of the ABC account?

Or rather, that is (not?) possible as stated under “Tunnel permissions” per .cert file?:

• Tunnel permissions · Cloudflare Zero Trust docs

In other words, short, can we manage multiple tunnels from different CF accounts to which we are added as “administrator/member”, with the advantage of using the same origin host/server?

Similar to what I found, not sure if related and if something changed since then, but:

Argo creds with multiple accounts

I don’t think so. That cert is created when you link the tunnel to a zone in your account. Note that it’s “account” (singular). You’re a single user on multiple accounts. Choose any hostname in your account. Cloudflare will issue credentials that are account-wide in scope; you do not need to pick a specific hostname where you plan to connect the Tunnel.

Or is it possible, but would have to run two separate cloudflared tunnels (one config with authenticated/cert for the zones/services of the CF “ABC” and the other of CF “DEF”)?

[nuno.diegues]

When you run a cloudflared tunnel, the only thing needed is a UUID.json file (called credentials file Useful terms · Cloudflare Zero Trust docs).

That file contains the tunnel UUID (in the file name), the tunnel Name, tunnel secret and account (in the file JSON contents).

Each cloudflared tunnel command can use 1 tunnel UUID.json file and run that tunnel.

That said, you can run as many cloudflared tunnel processes as you want within the same host/origin/machine, using as many different UUID.json files (possibly from different accounts) that you want.

[fritex]

Awesome! That’s the exact information that I needed to clarify.

@nuno.diegues Thank you very much for providing helpful information