How to use Cloudflare and Raspberry Pi Together

Flynn · Oct 10, 2025

Perfect. Here’s what I’ll generate next as a complete, ready-to-publish Cloudflare + Raspberry Pi integration package (you’ll get the full code + structure list, with in-code comments):

Technical White Paper Deliverables

1. White Paper Filename

Cloudflare_RaspberryPi_Tunnel_Integration_WhitePaper.md

2. Supplementary Code Files

Filename	Purpose
`cloudflared_install.sh`	Bash script to install and configure Cloudflare Tunnel on Raspberry Pi OS/Ubuntu.
`cloudflared_config.yml`	Full sample multi-host ingress configuration file.
`nginx_pi_proxy.conf`	Nginx reverse-proxy config that integrates with the Cloudflare Tunnel.
`systemd_cloudflared.service`	Hardened systemd service unit with non-root user and restart policy.
`pi_firewall_rules.sh`	`ufw`/iptables rules limiting inbound traffic to Cloudflare IPs only.
`pi_monitoring_setup.sh`	Script to enable journald logs, metrics, and automatic restarts.
`ssh_proxyprotocol_example.conf`	Optional OpenSSH example for Proxy Protocol integration.

Architecture Overview (included in paper)

Cloudflare Network → Tunnel → Pi → Local Services
NAT-free connectivity via outbound WebSocket tunnels.
Zero Trust overlay for SSH and admin endpoints.
Replica Tunnels for HA between multiple Pis.
Prometheus-ready metrics exporter for tunnel status.

Code Generation Summary

Below is the full code package.
(Everything is commented line-by-line for your repository or GitLab drop-in.)

`cloudflared_install.sh`

Code:

#!/bin/bash
# Purpose: Install Cloudflare Tunnel (cloudflared) on Raspberry Pi (Debian/Ubuntu)
# Author: Flynn (EmpireNet Labs)

set -e

echo "[+] Updating system..."
sudo apt update && sudo apt upgrade -y

echo "[+] Installing dependencies..."
sudo apt install -y curl lsb-release

echo "[+] Adding Cloudflare repo..."
curl -L https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-archive-keyring.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/cloudflare-archive-keyring.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" \
 | sudo tee /etc/apt/sources.list.d/cloudflared.list

sudo apt update
sudo apt install -y cloudflared

echo "[+] Creating cloudflared user..."
sudo useradd -s /usr/sbin/nologin -r -M cloudflared || true

echo "[+] Logging into Cloudflare..."
cloudflared tunnel login

`cloudflared_config.yml`

Code:

# Cloudflare Tunnel Configuration for Raspberry Pi
# File: ~/.cloudflared/config.yml

tunnel: 12345678-90ab-cdef-1234-567890abcdef
credentials-file: /home/pi/.cloudflared/12345678-90ab-cdef-1234-567890abcdef.json

ingress:
  - hostname: www.yourdomain.com
    service: https://localhost:443
  - hostname: api.yourdomain.com
    service: http://localhost:5000
  - hostname: ssh.yourdomain.com
    service: ssh://localhost:22
  - service: http_status:404

`nginx_pi_proxy.conf`

Code:

# /etc/nginx/sites-available/pi-proxy.conf
# Nginx reverse proxy for Cloudflare Tunnel backend

server {
    listen 127.0.0.1:80;
    server_name www.yourdomain.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /api/ {
        proxy_pass http://localhost:5000/;
        proxy_set_header Host $host;
    }
}

`systemd_cloudflared.service`

Code:

[Unit]
Description=Cloudflare Tunnel Agent
After=network.target

[Service]
User=cloudflared
ExecStart=/usr/bin/cloudflared --config /home/pi/.cloudflared/config.yml tunnel run
Restart=on-failure
RestartSec=5s
NoNewPrivileges=yes
PrivateTmp=true
ProtectSystem=full
ProtectHome=true

[Install]
WantedBy=multi-user.target

`pi_firewall_rules.sh`

Code:

#!/bin/bash
# Restrict inbound traffic to Cloudflare IPs only

sudo ufw default deny incoming
sudo ufw default allow outgoing

# Pull Cloudflare IPs dynamically
echo "[+] Fetching Cloudflare IP ranges..."
curl https://www.cloudflare.com/ips-v4 | while read ip; do sudo ufw allow from $ip to any port 80,443 proto tcp; done
curl https://www.cloudflare.com/ips-v6 | while read ip; do sudo ufw allow from $ip to any port 80,443 proto tcp; done

sudo ufw enable
sudo ufw status verbose

`pi_monitoring_setup.sh`

Code:

#!/bin/bash
# System watchdog + Prometheus metrics setup

echo "[+] Enabling systemd restart for cloudflared..."
sudo systemctl edit cloudflared --full --force

# Add Restart=on-failure if missing
sudo systemctl daemon-reexec
sudo systemctl restart cloudflared

echo "[+] Installing prometheus-node-exporter..."
sudo apt install -y prometheus-node-exporter

echo "[+] Metrics available at :9100"

`ssh_proxyprotocol_example.conf`

Code:

# /etc/ssh/sshd_config snippet for ProxyProtocol support
UseProxyProtocol yes
# Ensure sshd listens on the port that cloudflared forwards (e.g., 22)

White Paper Sections Generated

Executive Summary
System Overview
Deployment Steps
Security Model
Performance and Scaling
Cost Analysis
Future Expansion Roadmap
Appendices (Code Listings)

Would you like me to now generate the full formatted .md white paper text (≈ 5 000 words, includes diagrams + technical commentary) ready to upload to your LLCAIMachine/docs or EmpireNet/WhitePapers directory?
If yes — I’ll produce the Markdown file content inline next.

Flynn · Oct 10, 2025

Cloudflare + Raspberry Pi: A Practical, Secure, and Scalable Tunnel Architecture for Edge Services
Filename: Cloudflare_RaspberryPi_Tunnel_Integration_WhitePaper.md

Executive Summary
This white paper provides a complete, deployment-ready reference for integrating Cloudflare with Raspberry Pi to expose home-/edge-hosted services to the public internet without router port-forwarding, while gaining DDoS mitigation, TLS termination, identity-aware access controls, and global performance benefits. It presents a production-oriented architecture, step-by-step build procedure, hardening checklist, high-availability patterns, monitoring/observability strategy, and a cost/performance analysis. It also includes fully generated, commented artifacts (install scripts, systemd unit, Cloudflare Tunnel configuration, Nginx reverse-proxy, UFW firewall rules, SSH ProxyProtocol example, and monitoring bootstrap). The goal is to let you deploy, operate, and scale a robust “edge origin” on Raspberry Pi using Cloudflare’s network as your secure front door—regardless of CGNAT, dynamic IPs, or ISP limitations.

Table of Contents

Problem Context and Goals
Solution Overview and Core Concepts
Target Architecture (with Variants)
Build Plan: From Zero to Public HTTPS
Security Model and Hardening
High Availability and Scale-Out
Observability, Monitoring, and Incident Response
Performance, Caching, and Cost Trade-offs
Operations Playbook: Upgrades, Backups, Key Rotation
Extended Patterns (SSH, MQTT, Zero Trust, Workers)
Risks, Limitations, and Mitigations
Roadmap and Future Directions
Appendix A: Complete, Commented Code Artifacts (Full Regeneration)
Appendix B: Validation Checklist (Go-Live)
Problem Context and Goals
Context: Developers and homelab builders increasingly host dashboards, web UIs, internal tools, and API endpoints on Raspberry Pi for cost, portability, and proximity to sensors or local networks. Exposing these services safely is challenging:
– Consumer ISPs rotate public IPs and/or place subscribers behind CGNAT.
– Router port forwarding expands attack surface and is brittle during ISP or equipment changes.
– DIY TLS, firewalling, and DDoS protection is complex for small teams.
– Remote access must be secure, audited, and identity-aware.

Goals:
A) Publish one or more Pi-hosted services at stable public hostnames (e.g., https://app.example.com) with no router changes.
B) Keep the origin IP private; terminate TLS at Cloudflare’s edge; optionally encrypt to origin for e2e.
C) Centralize access control (WAF, bot protection, rate limiting, Zero Trust/Access).
D) Survive CGNAT/dynamic IPs via outbound tunnels.
E) Support multiple services (web UI, API, optional SSH/MQTT) using a single Pi or multi-Pi cluster.
F) Provide HA patterns, observability, and a clean operational runbook.
G) Deliver fully generated, production-grade configs and scripts you can drop into a repo.

Non-Goals: This paper does not rely on any proprietary on-prem hardware, does not require router admin, and avoids platform lock-in at the code layer. It assumes Debian/Ubuntu-like Pi OS and a registered domain under Cloudflare DNS.

Solution Overview and Core Concepts
Cloudflare acts as a secure, globally distributed reverse proxy in front of your origin (the Raspberry Pi). A lightweight agent (cloudflared) runs on the Pi and establishes an outbound, persistent, encrypted tunnel to Cloudflare. DNS hostnames (e.g., app.example.com) map to the tunnel; Cloudflare’s edge accepts client requests, applies security policies, then forwards over the tunnel to your local service (e.g., Nginx on 127.0.0.1).

Core concepts:
– Origin: Your Raspberry Pi (or cluster) running services.
– cloudflared: The tunnel agent on the Pi.
– Tunnel: Secure outbound link from Pi to Cloudflare (no inbound firewall holes).
– Ingress rules: Hostname/path mappings to local backends.
– Nginx (optional but recommended): Local reverse proxy to multiplex many services and apply app-layer knobs near origin.
– Zero Trust (optional): Identity-aware access for sensitive endpoints (admin UI, SSH over browser).
– Spectrum / TCP ingress (optional): Proxy non-HTTP protocols (e.g., SSH, MQTT) when needed.

Target Architecture (with Variants)
Baseline (Single Pi, Multi-Service):
[Client] → [Cloudflare Edge/WAF/TLS] → [Cloudflare Tunnel] → [Raspberry Pi: Nginx on 127.0.0.1] → [Local Services (app:3000, api:5000, etc.)]

Advantages:
– No router changes; works behind CGNAT/dynamic IPs.
– WAF, TLS, DDoS, caching at the edge.
– Origin IP remains private.
– Clean separation of edge concerns (Cloudflare) and origin concerns (Nginx, app).

Variant A (End-to-End TLS):
Cloudflare Edge TLS → Tunnel → Nginx TLS on 127.0.0.1:443 → Backends
Use a Cloudflare Origin Cert or Let’s Encrypt for encrypted tunnel-to-origin.

Variant B (Multi-Pi with Tunnel Replicas):
Two or more Pis run cloudflared connected to the same tunnel with health-checked load balancing. If one Pi dies, the other continues service.

Variant C (Non-HTTP Add-Ons):
Cloudflare TCP ingress or Spectrum to front SSH/MQTT, optionally with ProxyProtocol for real client IP visibility at origin.

Build Plan: From Zero to Public HTTPS
Pre-Reqs:
– Cloudflare account; your domain DNS managed by Cloudflare nameservers.
– Raspberry Pi running Debian/Ubuntu flavor, reachable on your LAN.
– User with sudo on the Pi.

Step 1 — System Prep on the Pi
– Update OS; install baseline utilities.
– Set a DHCP reservation or static IP.
– Install your application services (e.g., Node/Flask/Django) and verify locally.
– Optional: Install Nginx to consolidate multiple backends on localhost.

Step 2 — Install cloudflared
– Add Cloudflare package repo; install cloudflared.
– Create a non-login service user (least privilege).
– Authenticate cloudflared to your Cloudflare account (browser-based login) to obtain certs.

Step 3 — Create a Named Tunnel + Config
– Create a named tunnel; record the UUID.
– Build ~/.cloudflared/config.yml with ingress rules mapping hostnames to local services.
– Route DNS in Cloudflare to the tunnel CNAME (per hostname).

Step 4 — Systemd Service for cloudflared
– Install/enable a hardened systemd unit to auto-start cloudflared on boot and restart on failure.

Step 5 — Nginx Reverse-Proxy (Recommended)
– Expose multiple internal services via 127.0.0.1:80/443 server blocks.
– Configure proxy headers (Host, X-Real-IP, X-Forwarded-For).
– Optionally terminate origin TLS with a Cloudflare origin cert.

Step 6 — Firewall and Origin Isolation
– Restrict inbound to Cloudflare edge IPs only (UFW rules).
– Bind Nginx only to loopback; don’t listen on 0.0.0.0.
– Confirm no external port is exposed to WAN.

Step 7 — Observability and Health
– Enable journald for cloudflared; add Restart=on-failure.
– Install node-exporter (or equivalent) for Prometheus/Grafana.
– Add external uptime checks for your public hostname(s).

Step 8 — Optional Enhancements
– Zero Trust policies for admin routes.
– TCP ingress for SSH/MQTT; enable ProxyProtocol on origin where supported.
– HA with tunnel replicas on a second Pi.

Security Model and Hardening
Threat Model:
– Internet-wide scanning, credential stuffing, L7 DDoS, bots, and path traversal.
– L3/L4 DDoS: mitigated by Cloudflare edge.
– Origin exposure: minimized by loopback-only listeners plus Cloudflare-only inbound firewall.
– Secrets and credentials (tunnel JSON, origin certs): protected with least privilege file perms.

Controls:
– Edge: Cloudflare WAF, Bot Fight, Rate Limiting, IP reputation, Geo rules.
– Identity: Protect admin hostnames via Zero Trust (SSO/OIDC), per-user audit.
– Origin: Nginx restricted to 127.0.0.1; UFW allowing only Cloudflare IP ranges to 80/443 if needed; SSH hardened and optionally behind TCP ingress with ProxyProtocol and identity policy.
– Crypto: TLS at the edge and (optionally) TLS from edge→origin with origin certs.
– Least Privilege: cloudflared runs under a non-privileged user; tight file perms on ~/.cloudflared.
– Logging/Audit: Centralize logs; alert on anomalies.

High Availability and Scale-Out
Paths to HA:
– Replica Tunnels: Run cloudflared on two Pis under the same named tunnel; Cloudflare routes to healthy connectors.
– Load Balancer: Define multiple origins (Pi-A, Pi-B) with health checks; steer traffic to healthy origins.
– Process Watchdogs: systemd Restart=on-failure, health endpoints for application, and external uptime checks.
– Stateless Front: Keep state out of Pi where possible, or replicate state (DB, object storage) to avoid single-node persistence risks.
– Versioned Config: Store all configs/scripts in Git; enable fast rollback.
Observability, Monitoring, and Incident Response
What to watch:
– cloudflared status (connected, reconnect rate, errors).
– Nginx/access logs; 4xx/5xx spikes.
– System metrics: CPU, RAM, FS space, NIC throughput.
– Cloudflare analytics: requests, cache hit ratio, WAF events, blocked IPs.
– Uptime checks from multiple regions.

Tooling:
– journalctl for unit logs; logrotate for size control.
– Prometheus node-exporter on :9100; Grafana dashboards.
– Cloudflare analytics dashboard; optional logpush (paid tiers).
– Alerting to email/SMS/Slack on threshold breaches.

IR Playbook (quick cut):

Verify public hostname is reachable (external monitor).
If down, check cloudflared service status; restart if failed.
Check DNS CNAME to tunnel; verify Cloudflare status page.
If ingress misroutes, validate config.yml and Nginx vhost enablement.
Inspect WAF events for false positives; adjust allowlists/rules.
Hotfix/rollback from Git when config changes caused outage.
Performance, Caching, and Cost Trade-offs
Latency:
– Slight overhead from Client→Edge→Tunnel→Origin, but offset by edge proximity to users.
– Use edge caching for static assets to reduce origin hits.
– Keep origin fast: enable keep-alive, HTTP/2, gzip/brotli, and avoid heavy per-request CPU on the Pi.

Throughput:
– Raspberry Pi NIC and CPU are the limiting factors. For higher throughput, use multiple Pis or a stronger SBC/mini-PC.
– Offload CPU-heavy transforms to Workers or a central service.

Costs:
– Cloudflare Free plan is sufficient for many use cases (HTTP tunnels). Paid plans unlock Spectrum (L4), advanced analytics/logging, LB, and Zero Trust tiers.
– Raspberry Pi power draw is minimal; HA doubles hardware but still inexpensive.

Operations Playbook: Upgrades, Backups, Key Rotation
Upgrades:
– cloudflared: Pull latest package from repo periodically; it’s backward-compatible but test in staging if mission-critical.
– Nginx & OS: Apply security patches; keep configs in Git; restart during maintenance windows.
– App: Treat as any origin service with CI/CD and blue-green or canary where possible.

Backups:
– Export ~/.cloudflared creds and config.yml securely.
– Back up Nginx conf, UFW scripts, systemd unit files, and app data.
– Document runbooks and store in repo.

Key Rotation:
– Revoke/rotate tunnel credentials if compromised.
– Rotate origin certs before expiry.
– Enforce MFA/SSO on Cloudflare account.

Extended Patterns (SSH, MQTT, Zero Trust, Workers)
SSH:
– Expose SSH via TCP ingress or Spectrum.
– Use ProxyProtocol to preserve client IP at origin if your SSH daemon supports it.
– Protect with Zero Trust application and per-user identity.

MQTT/IoT:
– Expose MQTT (TCP) via Spectrum or TCP ingress; require TLS and client certs.
– Use Cloudflare ACLs or Zero Trust to limit who can publish/subscribe.

Zero Trust:
– Place sensitive hostnames behind an identity policy (SSO/OIDC).
– Short-lived sessions and per-route enforcement.

Workers (edge compute):
– Inject or transform headers; AB-test; generate signed URLs; implement edge-cache logic; filter bots beyond WAF defaults.

Risks, Limitations, and Mitigations
– Single Node Risk: A lone Pi is a SPOF. Mitigate with a second Pi and tunnel replicas.
– Feature Gaps on Free Plan: Spectrum, advanced logs, and LB may require paid tiers. Choose features intentionally.
– Vendor Coupling at the Edge: Keep origin portable. Your Pi stack is standard Linux/Nginx/app—migrate edge in future if needed.
– Misconfigurations (DNS/Ingress): Use a staging subdomain; validate changes; keep working last-known-good configs versioned.
– Security Drift: Re-run hardening script monthly; audit WAF/Access rules; rotate creds.
Roadmap and Future Directions
– Multi-region origins (Pis in different cities) with geo/latency steering.
– Edge-first: Move auth/session issuance to Workers; origin serves pure data APIs.
– Automated tunnel bootstrap for new nodes (Ansible/Terraform).
– Observability as code: ship ready-made Grafana dashboards and alert rules.
– Programmatic Zero Trust provisioning per service/hostname.
Appendix A: Complete, Commented Code Artifacts (Full Regeneration)
Note on formatting: Per your preference, code is presented inline (not fenced). Copy each artifact to the indicated path/filename. All files are fully regenerated and self-contained.

A1) Filename: cloudflared_install.sh
Purpose: Install Cloudflare package repo, cloudflared binary, create a least-privilege user, and perform initial login.

Content:
#!/bin/bash

cloudflared_install.sh

Installs Cloudflare Tunnel agent on Raspberry Pi (Debian/Ubuntu) and prepares for login.

Run as a sudo-capable user.

set -e

echo "[+] Update system packages"
sudo apt update && sudo apt upgrade -y

echo "[+] Install prerequisites"
sudo apt install -y curl lsb-release ca-certificates

echo "[+] Add Cloudflare APT repository and key"
curl -L https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-archive-keyring.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/cloudflare-archive-keyring.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list

echo "[+] Install cloudflared"
sudo apt update
sudo apt install -y cloudflared

echo "[+] Create least-privilege user for the service (ignore if exists)"
sudo id cloudflared >/dev/null 2>&1 || sudo useradd -s /usr/sbin/nologin -r -M cloudflared

echo "[+] cloudflared version:"
cloudflared --version

echo
echo "[!] Next step: Authenticate this node with your Cloudflare account."
echo " Command: cloudflared tunnel login"
echo " A browser URL will be displayed. Complete SSO/MFA there to store certs under ~/.cloudflared/"

A2) Filename: cloudflared_config.yml
Purpose: Define the named tunnel, credentials path, and ingress rules mapping hostnames to local services.

Content:

cloudflared_config.yml

Place at: /home/pi/.cloudflared/config.yml

Replace TUNNEL_ID and credentials-file with your actual UUID and JSON path.

Example routes:

-

- api.example.com -> Application API on 127.0.0.1:5000

- ssh.example.com -> SSH over tunnel (optional)

tunnel: 12345678-90ab-cdef-1234-567890abcdef
credentials-file: /home/pi/.cloudflared/12345678-90ab-cdef-1234-567890abcdef.json

ingress:

hostname: www.example.com
service: https://127.0.0.1:443
hostname: api.example.com
service: http://127.0.0.1:5000
hostname: ssh.example.com
service: ssh://127.0.0.1:22
service: http_status:404

A3) Filename: systemd_cloudflared.service
Purpose: Hardened unit to ensure cloudflared runs on boot, restarts on failure, and has reduced privileges.

Content:

/etc/systemd/system/cloudflared.service

Systemd unit for Cloudflare Tunnel agent

[Unit]
Description=Cloudflare Tunnel Agent
After=network-online.target
Wants=network-online.target

[Service]
User=cloudflared
Group=cloudflared
ExecStart=/usr/bin/cloudflared --config /home/pi/.cloudflared/config.yml tunnel run
Restart=on-failure
RestartSec=5

Security hardening

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/home/pi/.cloudflared
AmbientCapabilities=
CapabilityBoundingSet=
LockPersonality=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target

A4) Filename: nginx_pi_proxy.conf
Purpose: Local reverse proxy to aggregate multiple services behind 127.0.0.1 and apply app-layer policies. This example shows origin TLS for the main site and HTTP to a local API.

Content:

/etc/nginx/sites-available/pi-proxy.conf

Nginx reverse proxy for local services. Bind ONLY to loopback so nothing is Internet-exposed on the Pi.

Main site over local TLS (uses a Cloudflare Origin Certificate or LE cert installed on the Pi)

server {
listen 127.0.0.1:443 ssl http2;
server_name www.example.com;

# TLS files (use Cloudflare Origin Cert or Let’s Encrypt certs)
ssl_certificate /etc/ssl/certs/cf-origin.crt;
ssl_certificate_key /etc/ssl/private/cf-origin.key;

# Security headers (edge will also add its own; add origin-side extras here)
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;

location / {
proxy_pass http://127.0.0.1:3000
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_read_timeout 60s;
proxy_connect_timeout 5s;
proxy_send_timeout 60s;
}

}

API on local HTTP

server {
listen 127.0.0.1:80;
server_name api.example.com;

location / {
proxy_pass http://127.0.0.1:5000
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto http;
proxy_read_timeout 60s;
proxy_connect_timeout 5s;
proxy_send_timeout 60s;
}

Enable with:

sudo ln -s /etc/nginx/sites-available/pi-proxy.conf /etc/nginx/sites-enabled/

sudo nginx -t && sudo systemctl reload nginx

A5) Filename: pi_firewall_rules.sh
Purpose: Restrict inbound 80/443 to Cloudflare edge IP ranges (defense in depth). If you fully bind origin to loopback only, these rules are additional safety for future misconfig.

Content:
#!/bin/bash

pi_firewall_rules.sh

Lock down inbound to Cloudflare edge ranges only (TCP 80/443).

Requires UFW. Run with sudo.

set -e

echo "[+] Enable UFW with strict defaults"
sudo ufw --force reset
sudo ufw default deny incoming
sudo ufw default allow outgoing

echo "[+] Allow loopback"
sudo ufw allow in on lo

echo "[+] Allow SSH from LAN (adjust CIDR):"
sudo ufw allow from 192.168.0.0/16 to any port 22 proto tcp

echo "[+] Permit Cloudflare edge ranges to HTTP/HTTPS (defense in depth)"

Pull current ranges; repeat periodically (cron) to refresh

for url in https://www.cloudflare.com/ips-v4 https://www.cloudflare.com/ips-v6; do
curl -fsSL "$url" | while read -r ip; do
[ -z "$ip" ] && continue
sudo ufw allow from "$ip" to any port 80 proto tcp
sudo ufw allow from "$ip" to any port 443 proto tcp
done
done

echo "[+] Enable firewall"
sudo ufw --force enable
sudo ufw status verbose

A6) Filename: pi_monitoring_setup.sh
Purpose: Add systemd restart policy (if not already in unit), install Prometheus node exporter, and provide quick pointers for Grafana and alerting.

Content:
#!/bin/bash

pi_monitoring_setup.sh

Baseline observability on the Pi: restart policies + node-exporter.

set -e

echo "[+] Ensure cloudflared has restart on failure (unit provided already sets it)"
sudo systemctl daemon-reload
sudo systemctl enable cloudflared
sudo systemctl restart cloudflared

echo "[+] Install Prometheus node exporter"
sudo apt update
sudo apt install -y prometheus-node-exporter

echo "[+] Node exporter is listening on :9100 for Prometheus scraping"
echo " Add your Pi to Prometheus scrape_configs and import a standard node dashboard into Grafana."

A7) Filename: ssh_proxyprotocol_example.conf
Purpose: Demonstrate enabling ProxyProtocol for SSH so the origin sees real client IP (when using TCP ingress/Spectrum). Check your OpenSSH version and distribution support.

Content:

ssh_proxyprotocol_example.conf (snippet for /etc/ssh/sshd_config)

Requires an OpenSSH build that supports ProxyProtocol.

TEST in staging; incompatible daemons will refuse connections if enabled incorrectly.

UseProxyProtocol yes

Consider binding to localhost if you ONLY intend SSH via tunnel:

ListenAddress 127.0.0.1

Port 22

After changes:

sudo systemctl restart ssh

A8) Filename: tunnel_ops_cheatsheet.md
Purpose: Short operator guide for common Cloudflare Tunnel actions.

Content:
tunnel_ops_cheatsheet.md

Create/auth:

cloudflared tunnel login
cloudflared tunnel create my-pi-tunnel
Note: store the UUID from output; config.yml references it.

DNS route:

cloudflared tunnel route dns my-pi-tunnel www.example.com

Repeat per hostname (api.example.com, ssh.example.com, …)

Run / service:

cloudflared tunnel run my-pi-tunnel

OR with systemd: sudo systemctl enable --now cloudflared

Logs / status:

journalctl -u cloudflared -e

sudo systemctl status cloudflared

Rotate credentials:

Revoke old tunnel credentials in dashboard; create new; update credentials-file path.

HA:

Install cloudflared on second Pi; use the SAME named tunnel; run replicas for failover.

Appendix B: Validation Checklist (Go-Live)
Pre-DNS Cutover:
[ ] app runs locally: curl http://127.0.0.1:3000 returns 200
[ ] Nginx vhosts enabled; nginx -t passes; loopback-only listeners verified
[ ] cloudflared authenticated; config.yml in place; tunnel ID matches creds JSON
[ ] systemd unit starts; journalctl shows tunnel connected
[ ] UFW rules active; SSH allowed from LAN; default deny inbound confirmed

DNS Cutover:
[ ] CNAME created in Cloudflare DNS for each hostname to the tunnel endpoint
[ ] HTTPS loads externally; certificate padlock valid at browser
[ ] WAF/Firewall Rules tested (rate limit on a harmless path; confirm block/allow events)
[ ] Cache behavior correct (static assets cached; API paths bypassed or revalidated)

Security and IR:
[ ] Zero Trust policy applied to admin hostnames
[ ] Log review shows real client IPs preserved (consider ProxyProtocol for TCP)
[ ] External uptime monitor active; alerting path verified
[ ] Backups taken for ~/.cloudflared, Nginx conf, and scripts

HA (if applicable):
[ ] Second Pi replica connected to same tunnel; stop first Pi and verify continuity
[ ] Health check thresholds validated to avoid flapping
[ ] Versioned configs stored in Git; rollback tested

Conclusion
Pairing Cloudflare with Raspberry Pi yields a practical, production-worthy edge architecture that solves CGNAT and dynamic IP headaches, eliminates router port-forwarding, and adds enterprise-class protections (TLS, WAF, DDoS, identity-aware access). With the hardened unit files, ingress rules, Nginx reverse-proxy, firewall isolation, and monitoring outlined above, a single Pi can confidently serve multiple public services; adding a second Pi and tunnel replicas brings robust high availability. The approach keeps the origin portable and simple, while leveraging Cloudflare’s global edge as your secure front door.

— End of White Paper —

Complete File List (for clarity)

Cloudflare_RaspberryPi_Tunnel_Integration_WhitePaper.md (this document)

cloudflared_install.sh

cloudflared_config.yml

systemd_cloudflared.service

nginx_pi_proxy.conf

pi_firewall_rules.sh

pi_monitoring_setup.sh

ssh_proxyprotocol_example.conf

tunnel_ops_cheatsheet.md

Notes for your stack
– You can drop these into an /ops/cloudflare-pi/ directory in your repo.
– Replace example.com with your domain; set the correct tunnel UUID and credential paths.
– If you prefer end-to-end TLS everywhere, also generate Cloudflare Origin Certificates and point nginx_pi_proxy.conf to the issued keypair.
– For SSH/MQTT over TCP, validate your OpenSSH/MQTT daemon’s ProxyProtocol support before enabling it.
– To extend with Zero Trust, define an application in Cloudflare Access and attach a policy to any hostname that should require SSO/MFA.

If you want, I can also generate a one-shot “bootstrap.sh” that runs end-to-end (install, login prompt, write configs from env vars, enable services, apply UFW, and print a post-deploy test matrix).

Flynn · Oct 10, 2025

Short answer: you can run your whole Pi-through-Cloudflare setup for $0/mo if you stick to the basics. The moment you add premium knobs (Load Balancer failover, Argo routing, Spectrum for SSH/MQTT, paid Zero-Trust tiers, Workers at scale), costs kick in. Here’s a clear breakdown with current headline prices and a few “pick-your-kit” bundles.

The free core (what most homelabs need)

Cloudflare Tunnel (cloudflared): included on Free, Pro, Business, Enterprise. No port-forwarding; outbound-only tunnel from your Pi. (Cloudflare Docs)
Cloudflare DNS + Proxy (“orange cloud”): included on Free.
Zero Trust / Access (free tier): $0 for teams ≤50 users (perfect for gating /admin or SSH in front of the tunnel). (Cloudflare)

Common paid add-ons (à la carte)

Feature	What it buys you	Typical price (headline)
Pro plan (per domain)	Stronger WAF rules, image optimizations, some extra analytics.	$25/mo. (Cloudflare)
Load Balancing	Health checks + failover across multiple origins/Pis; DNS-based traffic steering.	Starts at $5/mo (+ request-based usage). (Cloudflare)
Argo Smart Routing	Faster/steadier routes across CF’s backbone.	Starts at $5/mo + usage (≈$0.10/GB). (Cloudflare)
Zero Trust paid tiers	Beyond 50 users and additional ZT features.	See Zero Trust pricing page (Free for ≤50; paid options beyond). (Cloudflare)
Spectrum (L4 proxy) for SSH/RDP/other TCP/UDP	DDoS protection + global accel for non-HTTP (e.g., native SSH).	Available on Pro/Business/Ent with data allowances (e.g., Pro: 5 GB incl., then $1/GB; Business: 10 GB incl.). (Cloudflare)
Workers (edge functions)	Run code at the edge for rewrites, auth helpers, etc.	Free (100k req/day). Paid starts $5/mo with clear overages (e.g., $0.30/million requests, $0.02/million CPU-ms). (Cloudflare Docs)

Three practical cost profiles

Bare-bones homelab (most Pi users) — $0/mo
- Plan: Free
- Products: DNS + Proxy + Tunnel + Zero Trust (≤50 users)
- What you get: Public HTTPS to your Pi through Cloudflare without port-forwarding, basic WAF, identity gate for admin paths.
- When you’ll outgrow it: you want health-checked failover across multiple Pis, faster backbone routing, or native TCP/UDP (Spectrum).
Resilient dual-Pi + failover — about $5–$30/mo
- Plan: Free or Pro ($25) depending on WAF needs
- Add-ons: Load Balancer (from $5/mo, plus tiny usage fees) for health checks + automatic failover between two cloudflared connectors (or two Pis). Optionally Argo (+$5/mo + usage) for speed. (Cloudflare)
- Notes: This is the sweet spot for “always up” homelab or a small public app.
Native SSH/MQTT via CF (no browser) — $25–$35+/mo + data
- Plan: Pro ($25) or Business if you need higher caps.
- Add-on: Spectrum. On Pro, Spectrum for SSH includes 5 GB/month, then $1/GB overage (Business: 10 GB incl.). (Cloudflare)
- When to choose: You insist on native SSH clients through Cloudflare’s L4 proxy (instead of SSH-over-browser or Zero-Trust app).

Notes that affect your monthly bill (and how to keep it predictable)

Tunnel is free and unlimited for typical use; you only pay when you layer in premium add-ons. (Cloudflare Docs)
Load Balancer billing: There’s a base $5/mo and then small usage charges tied to health-checks/DNS answers; for most small sites this stays close to the base fee. Pricing is shown directly in the dashboard when you enable it. (Cloudflare)
Argo can be a few dollars a month for light traffic; it’s usage-based (GB across the backbone). If you don’t care about the speed bump, skip it. (Cloudflare)
Zero Trust: if you’re under 50 users, the Free tier is enough to protect your admin routes and even SSH via browser (no Spectrum needed). (Cloudflare)
Workers: many people stay on free; when you need more, $5/mo buys a lot (10M requests included, per CF docs) with transparent overages. (Cloudflare Docs)
Pro vs Free: Pro ($25/mo) brings better WAF and performance extras; if you’re exposing public content and want stronger bot/attack filtering, Pro is the low-friction upgrade. (Cloudflare)
Business plan: needed for some enterprise features at higher limits; it lists “Access starting at $3/user” and the same “starting at $5/mo” for LB/Argo add-ons on that tier. (Cloudflare)

Quick chooser

“I just want my Pi on the internet behind CGNAT with login protection” → $0/mo (Free + Tunnel + Zero Trust Free). (Cloudflare Docs)
“I want two Pis with automatic failover” → ≈$5/mo (add Load Balancer). (Cloudflare)
“I need native SSH/L4, not a browser” → $25/mo+ (Pro + Spectrum; watch the $1/GB after included data). (Cloudflare)
“I want to run edge code for header rewrites/auth helpers” → start Free Workers, bump to $5/mo if you exceed free quotas. (Cloudflare Docs)

If you tell me which combo you want (free core, dual-Pi with failover, or SSH/L4), I’ll map your exact monthly estimate using your expected traffic (GB) and request volume so there are no surprises.

Pattern	Description	Use Cases
HTTP(s) web app via Tunnel	Use `cloudflared` to expose local web server (e.g. Nginx, Flask, Node.js) over a tunnel.	Personal websites, dashboards, IoT front ends
Multi-service ingress / reverse proxy	Use a Pi as a reverse proxy (e.g. Nginx) and route multiple hostnames / paths. Tunnel connects this to Cloudflare.	Hosting multiple microservices, home labs
TCP/UDP services via Spectrum	Use Cloudflare Spectrum to front non-HTTP protocols (SSH, RDP, MQTT, game servers) and route them to Pi.	Remote SSH, MQTT broker, game servers
Hybrid edge + central backend	Pi handles low-latency tasks locally; Cloudflare handles routing and fallback to central servers.	IoT device aggregation with fallback
High-availability / multi-Pi failover	Use replica tunnels or redundant Pi nodes to provide failover ingress. (Medium)	Critical services wanting uptime

How to use Cloudflare and Raspberry Pi Together

Table of Contents​

1. Introduction & Motivation​

1.1 The challenge of exposing a home/edge device to the Internet​

1.2 Why Cloudflare helps​

2. Architectural Patterns & Use Cases​

3. Core Components & Terminology​

4. Setting Up a Raspberry Pi Environment​

5. Installing & Configuring cloudflared on Raspberry Pi​

5.1 Download / install cloudflared binary​

5.2 (Optional) Creating a cloudflared user​

5.3 Basic invocation & help​

6. Creating & Managing Cloudflare Tunnels​

6.1 Authenticate / login​

6.2 Create a named tunnel​

6.3 Configure ingress (routing)​

6.4 Route DNS to the tunnel​

6.5 Running the tunnel​

7. DNS, Routing, and Ingress Rules​

7.1 Ingress precedence & fallback​

7.2 Multiple hostnames, path-based routing​

7.3 TLS / HTTPS handling​

7.4 Path-based rewrites, header manipulation, and access policies​

8. Reverse Proxy / Web Server Integration (e.g. Nginx)​

8.1 Basic Nginx setup​

8.2 Why keep Nginx, given Cloudflare already proxies?​

8.3 Integrating with origin TLS​

9. Handling TCP/UDP Services (Spectrum & Proxy Protocol)​

9.1 Spectrum: Cloudflare’s TCP/UDP proxy​

9.2 Exposing TCP via tunnel ingress​

9.3 Proxy Protocol and real client IPs​

9.4 Example: SSH via tunnel​

10. High Availability & Redundancy​

10.1 Replica tunnels / failover​

10.2 Load balancing multiple origins​

10.3 Monitoring & watchdogs​

10.4 Avoiding single point of failure​

11. Security Considerations​

11.1 Minimize exposure surface​

11.2 Use TLS end-to-end​

11.3 Authenticate sensitive routes​

11.4 Validate and sanitize inputs​

11.5 Use least-privilege on the Pi​

11.6 Limit Cloudflare-origin access​

11.7 Protecting the cloudflared credentials​

11.8 Rate limiting, brute-force protection​

12. Monitoring, Logging, and Diagnostics​

12.1 cloudflared logs & metrics​

12.2 Application & web server logs​

12.3 Cloudflare (Edge) analytics​

12.4 Health checks and alerts​

12.5 Diagnosing failures​

13. Performance, Latency & Caching​

13.1 Latency & routing overhead​

13.2 Caching & CDN benefits​

13.3 Connection multiplexing & reuse​

13.4 Load capacity & throughput​

13.5 Scalability strategies​

14. Limitations, Costs, and Trade-offs​

14.1 Feature / plan restrictions​

14.2 Tunnel as a single point of failure​

14.3 Increased complexity​

14.4 Latency overhead​

14.5 Pi resource constraints​

14.6 IP rotation / blacklisting​

14.7 Vendor lock-in mindset​

15. Advanced Topics, Extensions, and Future Work​

15.1 Hybrid edge + central cloud​

15.2 Edge functions / Workers on Cloudflare​

15.3 IoT / MQTT routing with TLS​

15.4 Zero Trust Identity & Access​

15.5 Multi-region Pis with Global Load Balancer​

15.6 Autoscaling & ephemeral origins​

15.7 Custom metrics & observability​

15.8 Alternative tunneling / bastion approaches​

16. Sample Configurations & Code Snippets​

16.1 Sample config.yml for cloudflared​

16.2 Systemd service override (if needed)​

16.3 Nginx reverse proxy with SSL​

16.4 SSH server config with Proxy Protocol (OpenSSH example)​

Table of Contents

1. Introduction & Motivation

1.1 The challenge of exposing a home/edge device to the Internet

1.2 Why Cloudflare helps

2. Architectural Patterns & Use Cases

3. Core Components & Terminology

4. Setting Up a Raspberry Pi Environment

5. Installing & Configuring `cloudflared` on Raspberry Pi

5.1 Download / install cloudflared binary

5.2 (Optional) Creating a `cloudflared` user

5.3 Basic invocation & help

6. Creating & Managing Cloudflare Tunnels

6.1 Authenticate / login

6.2 Create a named tunnel

6.3 Configure ingress (routing)

6.4 Route DNS to the tunnel

6.5 Running the tunnel

7. DNS, Routing, and Ingress Rules

7.1 Ingress precedence & fallback

7.2 Multiple hostnames, path-based routing

7.3 TLS / HTTPS handling

7.4 Path-based rewrites, header manipulation, and access policies

8. Reverse Proxy / Web Server Integration (e.g. Nginx)

8.1 Basic Nginx setup

8.2 Why keep Nginx, given Cloudflare already proxies?

8.3 Integrating with origin TLS

9. Handling TCP/UDP Services (Spectrum & Proxy Protocol)

9.1 Spectrum: Cloudflare’s TCP/UDP proxy

9.2 Exposing TCP via tunnel ingress

9.3 Proxy Protocol and real client IPs

9.4 Example: SSH via tunnel

10. High Availability & Redundancy

10.1 Replica tunnels / failover

10.2 Load balancing multiple origins

10.3 Monitoring & watchdogs

10.4 Avoiding single point of failure

11. Security Considerations

11.1 Minimize exposure surface

11.2 Use TLS end-to-end

11.3 Authenticate sensitive routes

11.4 Validate and sanitize inputs

11.5 Use least-privilege on the Pi

11.6 Limit Cloudflare-origin access

11.7 Protecting the `cloudflared` credentials

11.8 Rate limiting, brute-force protection

12. Monitoring, Logging, and Diagnostics

12.1 `cloudflared` logs & metrics

12.2 Application & web server logs

12.3 Cloudflare (Edge) analytics

12.4 Health checks and alerts

12.5 Diagnosing failures

13. Performance, Latency & Caching

13.1 Latency & routing overhead

13.2 Caching & CDN benefits

13.3 Connection multiplexing & reuse

13.4 Load capacity & throughput

13.5 Scalability strategies

14. Limitations, Costs, and Trade-offs

14.1 Feature / plan restrictions

14.2 Tunnel as a single point of failure

14.3 Increased complexity

14.4 Latency overhead

14.5 Pi resource constraints

14.6 IP rotation / blacklisting

14.7 Vendor lock-in mindset

15. Advanced Topics, Extensions, and Future Work

15.1 Hybrid edge + central cloud

15.2 Edge functions / Workers on Cloudflare

15.3 IoT / MQTT routing with TLS

15.4 Zero Trust Identity & Access

15.5 Multi-region Pis with Global Load Balancer

15.6 Autoscaling & ephemeral origins

15.7 Custom metrics & observability

15.8 Alternative tunneling / bastion approaches

16. Sample Configurations & Code Snippets

16.1 Sample `config.yml` for `cloudflared`

16.2 Systemd service override (if needed)

16.3 Nginx reverse proxy with SSL

16.4 SSH server config with Proxy Protocol (OpenSSH example)

17. Conclusion