5Stack

Appearance

Cloudflare Tunnel ​

Requirements: DNS managed by Cloudflare, SSL/TLS mode set to Full

You can expose your 5Stack installation through a Cloudflare Tunnel (cloudflared) without opening inbound firewall ports.

Create the tunnel ​

  1. Sign in to the Cloudflare dashboard with the account that owns your domain.
  2. Navigate to Protect & Connect → Networking → Tunnels.
  3. Click + Create Tunnel, enter a name, and click Create Tunnel.
  4. Follow the on-screen installation guide and select Install as a service.

Add routes ​

  1. Open the tunnel, go to Routes, and click Add route.
  2. Select Published application and fill in the fields. Repeat for each subdomain 5Stack provisions:
DomainService address
yourdomain.comhttps://localhost:443
yourdomain.comhttp://localhost:80
api.yourdomain.comhttps://localhost:443
ws.yourdomain.comhttps://localhost:443
demos.yourdomain.comhttps://localhost:443
search.yourdomain.comhttps://localhost:443
console.yourdomain.comhttps://localhost:443
inventory.yourdomain.comhttps://localhost:443

Tailscale users

Replace localhost with the node's local Tailscale IP address. These values can be updated later.

Disable TLS verification ​

Because 5Stack provisions its own certificates. You must disable TLS verification on each route; otherwise the tunnel cannot reach the backend.

  1. Go to Protect & Connect → Zero Trust → Networks → Tunnels & Mesh.
  2. Find your tunnel and click ⋯ → Configure.
  3. In the Published application routes section, click ⋯ → Edit on each route.
  4. Scroll to Origin request and connection settings → TLS and enable No TLS verify.

WARNING

This step must be completed for every published application route in the list.

Your 5Stack installation is now accessible through Cloudflare Tunnel.

Because traffic reaches the panel through Cloudflare, set REVERSE_PROXY=true. See Reverse Proxy.