Deploy Your App from a Home to the Public Internet with Docker and Cloudflare Zero Trust Tunnels

November 9, 2024

Introduction

Deploying apps from a home server doesn’t have to mean wrestling with port forwarding or risking exposure of your IP address. With Docker and Cloudflare Zero Trust Tunnels, you can securely publish your app to the world in minutes—no networking expertise required. This updated guide follows Cloudflare’s official Zero Trust documentation, simplifying setup with their user-friendly dashboard. Let’s dive in!

Why Docker and Cloudflare Zero Trust Tunnels?

  • Docker ensures your app runs consistently by packaging it into a container.
  • Cloudflare Zero Trust Tunnels (formerly Argo Tunnels) safely expose your app without opening ports on your router.
  • Zero Trust Security: Add layers of protection, like authentication policies, directly from Cloudflare’s dashboard.

No static IPs, no port forwarding, and no need to expose your home network.

Step 1: Containerize Your App with Docker

  1. Install Docker
    On Ubuntu/Debian:

    curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER
sudo systemctl enable docker --now

  2. Create a Dockerfile
    Example for a Node.js app:

    FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
CMD ["npm", "start"]

  3. Run Your App with Docker Compose
    Create docker-compose.yml:

    version: '3.8'
services:
  app:
    build: .
    ports:
      - "3000:3000" # Map host port 3000 to container port 3000
    restart: unless-stopped

    Start the container:

    docker compose up -d

Step 2: Expose Your App with Cloudflare Zero Trust Tunnels

Cloudflare’s Zero Trust dashboard simplifies tunnel creation. Here’s how:

  1. Sign Up for Cloudflare & Add a Domain

    • Create a free account at cloudflare.com.
    • Add your domain (e.g., example.com) and follow the DNS setup prompts.

  2. Install cloudflared on Your Home Server
    Use Cloudflare’s package repository for easy updates:

    sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-archive-keyring.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/cloudflare-archive-keyring.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list
sudo apt-get update && sudo apt-get install cloudflared

  3. Create a Tunnel via the Zero Trust Dashboard

    • Go to Zero Trust Dashboard > Access > Tunnels.
    • Click Create Tunnel and name it (e.g., home-server).
    • Copy the Tunnel Token shown on the next screen.

  4. Run the Tunnel on Your Home Server
    Authenticate and start the tunnel using the token:

    # Paste the token from the dashboard
sudo cloudflared service install <YOUR_TUNNEL_TOKEN>

    This automatically creates a systemd service to keep the tunnel running.

  5. Route Traffic to Your App

    • Back in the Zero Trust dashboard, go to your tunnel’s Public Hostname tab.
    • Click Add a Public Hostname:
      • Subdomain: E.g., myapp (to create myapp.example.com).
      • Domain: Select your domain (e.g., example.com).
      • Path: Leave blank to route all traffic.
      • Service: Enter http://localhost:3000 (matching your Docker app’s port).
    • Click Save.

Step 3: Secure Your App (Optional)

Cloudflare Zero Trust offers built-in security features:

  1. Enable HTTPS: SSL/TLS encryption is auto-configured for your domain.
  2. Restrict Access:
    • In the Zero Trust dashboard, go to Access > Applications > Create an Application.
    • Select your domain and set up policies (e.g., require email verification or GitHub login).

Troubleshooting

  • Tunnel Offline? Check status with: 
    systemctl status cloudflared
  • App Not Loading? Confirm your Docker container is running: 
    docker ps
  • DNS Issues? Ensure your domain’s nameservers point to Cloudflare.

Conclusion

By combining Docker with Cloudflare Zero Trust Tunnels, you’ve bypassed complex networking hurdles and secured your app with enterprise-grade tools—for free. Whether you’re hosting a blog, a portfolio, or a side project, this setup keeps your home network safe while putting your work in the spotlight.

Need More Help?