Skip to main content
A Cloudflare Tunnel works by connecting outward — the cloudflared connector on your machine reaches out to Cloudflare’s network, so nothing on your side is directly reachable from the internet. Cloudflare terminates TLS for you at their edge and forwards traffic through the tunnel to your instance. No open firewall ports, no certificate management. This is one of the two tested deployment methods for exposing plamotrack to the internet.

​
Prerequisites

The cloudflared connector can run on the same host as your plamotrack stack or on a separate machine. Both work; the tested configuration has the connector on a separate machine, reaching the stack over the LAN.

​
Set up the tunnel route

1

Open Zero Trust Dashboard

In the Cloudflare dashboard, go to Zero Trust → Networks → Tunnels. Select your tunnel (or create one if you haven’t yet).
2

Add a public hostname

Add a public hostname route to your tunnel:
  • Hostname: the domain you want plamotrack at (e.g. plamotrack.example.com)
  • Service type: HTTP
  • URL: the address the connector uses to reach your instance — http://127.0.0.1:8080 if the connector is on the same machine, or the LAN address of the host if it’s on a different machine

​
Update your .env

Add or edit these three lines in your .env:
Then bring the stack back up:
What each line does:
  • WEB_BIND keeps the port closed to everything except the connector. With the connector on the same host that is 127.0.0.1, and Cloudflare is the only way in. With the connector on another machine it is the address that machine reaches this host at — a LAN or mesh address, never 0.0.0.0 — and the hop between them is plain HTTP on your own network, the same assumption as a LAN install.
  • PUBLIC_BASE_URL tells plamotrack what address browsers see. Without this, every save from the browser returns a 403 ingress.origin_not_allowed error because the browser’s https:// origin doesn’t match the instance’s plain-HTTP socket.
  • TRUSTED_PROXIES tells plamotrack to trust X-Forwarded-For headers from the connector, so rate limits and the audit log see your actual visitors rather than the connector’s address. Cloudflare sets that header to the visitor.
PUBLIC_BASE_URL’s host is automatically added to the allowed-hosts list, so you don’t need to set ALLOWED_HOSTS separately for the public name.

​
Verify it works

From any device, open:
You should get back {"status":"ok"}. Then open the app in your browser and claim the instance if you haven’t already — run docker compose logs api | grep -A6 "no owner yet" to find the setup token. Cloudflare Access can sit in front of the hostname as well; the plamotrack login still applies behind it.

​
MCP and AI assistants

Once plamotrack is behind TLS with PUBLIC_BASE_URL set, you can connect Claude web, ChatGPT web, Gemini Spark and Mistral directly from their connector dialogs — just paste https://plamotrack.example/mcp/ as the MCP URL. In OIDC Login mode (AUTH_MODE=oidc), those web clients can sign in without you pasting a token: they discover the instance as an OAuth server, send you to your identity provider, and receive their own access tokens. Personal access tokens continue to work in this mode too.
Cloudflare enforces a 125-second limit on the time to a response’s first headers. A very large CSV import that takes over 125 seconds to respond will produce a Cloudflare 524 error in your browser — but the import still completes on the server. MCP is a streaming protocol (text/event-stream, which is what tells the tunnel not to buffer), and the limit is on the headers, not the stream: a stream held idle stays open, since Cloudflare’s idle limit is 900 seconds and the API sends a keepalive every 15 seconds. AI assistant connections are unaffected.