{"slug": "cloudflare-tunnel", "name": "Cloudflare Tunnel", "category": "networking", "category_name": "Networking and VPN", "description": "Cloudflare service that publishes local servers through outbound connections from the cloudflared daemon.", "recommenders": 27, "commenters": 59, "warners": 7, "score": 23.376, "rising": 4.44, "first": "2025-11-03", "latest": "2026-10-24", "why": "Loved for putting home and self-hosted services online without opening any ports, at no cost beyond a domain, with fairly easy setup.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 31, "neutral": 24, "compare": 3, "warn": 7}, "spark": [4, 3, 2, 0, 2, 4, 2, 0, 4, 1, 6, 3], "listed": true, "loved": ["No open ports", "Free"], "caveat": "Config pain", "short_quote": "I rely on normal Cloudflare Tunnels for my self-hosted website/web apps, works shockingly well", "kind": "", "icon": true, "domain": "cloudflare.com", "github_repo": null, "official_url": "https://www.cloudflare.com/products/tunnel/", "pricing": "freemium", "aliases": ["Cloudflare Tunnel"], "verdict": [{"text": "Loved for putting home and self-hosted services online without opening any ports,", "cites": [{"id": 741607712, "item_id": 46350482, "url": "https://news.ycombinator.com/item?id=46350482", "by": "j45", "date": "2025-12-21", "stance": "recommend", "quote": "The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever.", "excerpt": "No such thing as a stupid question. If you plug in a machine at home, it is behind the router, and behind the router's firewall. If you want more of a firewall locally, something as simple as an EdgeRouter X can get you started easily with this excellent guide: https://github.com/mjp66/Ubiquiti The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever. The cloudflare tunnel app running on you", "context": "", "use_case": "expose home server without open ports", "switched_from": "", "story": "I got hacked: My Hetzner server started mining Monero"}, {"id": 741728608, "item_id": 46358038, "url": "https://news.ycombinator.com/item?id=46358038", "by": "j45", "date": "2025-12-22", "stance": "recommend", "quote": "nothing is open to the public at all", "excerpt": "Exposing ports on home ip: - exposes the port to be available for inbound connections from anyone on the public internet. When we use a web browser, it's outbound first which initiates responses. - with an exposed port, you are that much more at the mercy of your firewalls ability to protect and defend the open port, which becomes more of a consideration. - some people take additional security steps to only allow cer", "context": "", "use_case": "Expose services without open ports", "switched_from": "", "story": "I got hacked: My Hetzner server started mining Monero"}, {"id": 769133264, "item_id": 48070829, "url": "https://news.ycombinator.com/item?id=48070829", "by": "Lord_Zero", "date": "2026-05-08", "stance": "recommend", "quote": "you should consider using cloudflare tunnel", "excerpt": "I would highly recommend not putting your home network at risk and poking holes into it. If you just self host a public site on your home network you should consider using cloudflare tunnel.", "context": "", "use_case": "exposing self-hosted site safely", "switched_from": "", "story": "Hosting a Site on a Raspberry Pi"}, {"id": 763961360, "item_id": 47747585, "url": "https://news.ycombinator.com/item?id=47747585", "by": "arjie", "date": "2026-04-12", "stance": "recommend", "quote": "Cloudflare Tunnel is a wonderful thing.", "excerpt": "Cloudflare Tunnel is a wonderful thing. In fact, Cloudflare itself is fantastic for homelabbers because it gives you so much for free. I used to just host direct on my own home IP, but nowadays I find it easier to just `cloudflared`. Don't have to worry about the firewall and any breaches into my network and all of that stuff. I started from a similar place as you and then eventually now my IaaC for my homelab is jus", "context": "homelabber", "use_case": "exposing homelab services", "switched_from": "direct hosting on home IP", "story": "State of Homelab 2026"}]}, {"text": " at no cost beyond a domain,", "cites": [{"id": 785876224, "item_id": 49117264, "url": "https://news.ycombinator.com/item?id=49117264", "by": "giobox", "date": "2026-07-30", "stance": "recommend", "quote": "I use this all the time for personal projects", "excerpt": "> Enable cloud tunnels so you can access your apps on other devices (paid feature) It's not much extra work to do this technique (tunnel to publicly accessible domain name from locally or privately hosted setup) with cloudflare tunnels. It's also completely free, all you need is a domain name managed by cloudflare (~10 bucks a year). You just throw up a cloudflared container (can be part of your local docker compose ", "context": "", "use_case": "expose local apps publicly", "switched_from": "", "story": "Show HN: Port Zero \u2013 how I learned to stop worrying and love PORT=0"}, {"id": 796128128, "item_id": 49758008, "url": "https://news.ycombinator.com/item?id=49758008", "by": "cmacleod4", "date": "2026-09-18", "stance": "recommend", "quote": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now.", "excerpt": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now. The only thing I had to pay for was the DNS registration. There are limits on the traffic you can serve on their free plan, but I'm nowhere near reaching those. I don't know what an SDK would add, you just set up a web server using whatever method suits you, then configure the cloudflared to connect to that. I did ", "context": "self-hosts websites at home", "use_case": "hosting websites from home", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 755939185, "item_id": 47246199, "url": "https://news.ycombinator.com/item?id=47246199", "by": "carlnewton", "date": "2026-03-04", "stance": "recommend", "quote": "Traffic comes in using a cloudflare tunnel.", "excerpt": "I've just moved away from hosting on AWS to buying a refurbished Dell Optiplex 5060 and installing docker compose on it. Traffic comes in using a cloudflare tunnel. The only costs are electricity (it's very low power and virtually silent) and the domain (if you need one), and I'm thrilled with it.", "context": "", "use_case": "exposing self-hosted server", "switched_from": "", "story": "Ask HN: What's your experience self-hosting in 2026?"}, {"id": 783412800, "item_id": 48963300, "url": "https://news.ycombinator.com/item?id=48963300", "by": "busymom0", "date": "2026-07-18", "stance": "recommend", "quote": "Only thing I rely upon someone for is Cloudflare tunnels for free. I could replace that with port forwarding but so far, this way is pretty good.", "excerpt": "I self host my site [1] on an old Mac mini in a Swift backend and sqlite database. Only thing I rely upon someone for is Cloudflare tunnels for free. I could replace that with port forwarding but so far, this way is pretty good. [1] https://limereader.com/", "context": "", "use_case": "expose self-hosted site", "switched_from": "", "story": "Hardcore IndieWeb: Run your own website 100% independently for only $0.01/day"}]}, {"text": " with fairly easy setup.", "cites": [{"id": 796205841, "item_id": 49762865, "url": "https://news.ycombinator.com/item?id=49762865", "by": "allthetime", "date": "2026-09-19", "stance": "recommend", "quote": "If i want to expose something for friends who don\u2019t use Tailscale I connect a cloudflare tunnel\u2026 it\u2019s pretty much a couple clicks", "excerpt": "I use public dns routed to private Tailscale ips for all my home services. If i want to expose something for friends who don\u2019t use Tailscale I connect a cloudflare tunnel\u2026 it\u2019s pretty much a couple clicks and typing in a subdomain name once cloudflared is running on a server\u2026 what were you having trouble with?", "context": "homelab user", "use_case": "exposing services publicly", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 763975168, "item_id": 47748448, "url": "https://news.ycombinator.com/item?id=47748448", "by": "antihero", "date": "2026-04-12", "stance": "recommend", "quote": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi.", "excerpt": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi. Interestingly, in the early hours of this morning I switched from Cloudflare Tunnels to a rathole/traefik based solution (well, currently it's port forwarding and a low grade home-baked dyndns solution until I get paid and can afford a cheap hetzner box because I spent all of my money again). I switched back because I ", "context": "", "use_case": "", "switched_from": "", "story": "State of Homelab 2026"}, {"id": 796173184, "item_id": 49760824, "url": "https://news.ycombinator.com/item?id=49760824", "by": "girvo", "date": "2026-09-18", "stance": "recommend", "quote": "I rely on normal Cloudflare Tunnels for my self-hosted website/web apps, works shockingly well", "excerpt": "This is super neat! I rely on normal Cloudflare Tunnels for my self-hosted website/web apps, works shockingly well all things considered. It was pretty easy to setup\u2026 but I cheated, and use Dokploy which handled most of it AFAICT", "context": "", "use_case": "expose self-hosted web apps", "switched_from": "", "story": "Cloudflare Quick Tunnels"}]}, {"text": " The most common complaint is fiddly configuration and a limited or broken Zero Trust dashboard,", "cites": [{"id": 796174672, "item_id": 49760917, "url": "https://news.ycombinator.com/item?id=49760917", "by": "JeremyJaydan", "date": "2026-09-18", "stance": "recommend", "quote": "I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes.", "excerpt": "I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes. It's nice to see a simpler version even if it's just for testing.", "context": "", "use_case": "production tunneling", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796128128, "item_id": 49758008, "url": "https://news.ycombinator.com/item?id=49758008", "by": "cmacleod4", "date": "2026-09-18", "stance": "recommend", "quote": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now.", "excerpt": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now. The only thing I had to pay for was the DNS registration. There are limits on the traffic you can serve on their free plan, but I'm nowhere near reaching those. I don't know what an SDK would add, you just set up a web server using whatever method suits you, then configure the cloudflared to connect to that. I did ", "context": "self-hosts websites at home", "use_case": "hosting websites from home", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796111761, "item_id": 49756985, "url": "https://news.ycombinator.com/item?id=49756985", "by": "TIPSIO", "date": "2026-09-18", "stance": "warn", "quote": "between the broken dashboard side of Zero Trust and nightmare of Warp\u2026 it was basically impossible to setup.", "excerpt": "My wife and I have a mobile group/shared bot system where we can make mini apps and collab. Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc\u2026 We have Tailscale on our phones and can instantly and privately see without deployment or anything crazy via our secure VPN. Think shared Claude Artifacts that don\u2019t live @ Anthropic. Tried to first do this with Cloud", "context": "", "use_case": "private access to mini apps", "switched_from": "", "story": "Cloudflare Quick Tunnels"}]}, {"text": " plus limits such as a 100MiB request cap and terms that discourage media streaming.", "cites": [{"id": 780317392, "item_id": 48769837, "url": "https://news.ycombinator.com/item?id=48769837", "by": "1una", "date": "2026-07-02", "stance": "warn", "quote": "Cloudflare Tunnel blocks requests above 100MiB", "excerpt": "Note that Cloudflare Tunnel blocks requests above 100MiB, which makes it impossible to upload long videos. This is being addressed in https://github.com/immich-app/immich/pull/22385", "context": "", "use_case": "", "switched_from": "", "story": "Immich v3.0.0 Released"}, {"id": 763964096, "item_id": 47747756, "url": "https://news.ycombinator.com/item?id=47747756", "by": "AdrienPoupa", "date": "2026-04-12", "stance": "warn", "quote": "you should not use Cloudflare Tunnels to stream media", "excerpt": "This is very cool, but you should not use Cloudflare Tunnels to stream media. This is forbidden by their terms of service (or at the very least not the intended use of Tunnels and they may disable your service). Use Wireguard or Tailscale instead. https://www.xda-developers.com/cloudflare-tunnels-are-great-but-never-use-them-for-media-streaming/", "context": "", "use_case": "Exposing local services", "switched_from": "", "story": "State of Homelab 2026"}]}], "praise": [{"label": "No open ports", "summary": "Keeps the home network closed because cloudflared connects outward, so nothing needs port forwarding.", "quotes": [{"id": 741607712, "item_id": 46350482, "url": "https://news.ycombinator.com/item?id=46350482", "by": "j45", "date": "2025-12-21", "stance": "recommend", "quote": "The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever.", "excerpt": "No such thing as a stupid question. If you plug in a machine at home, it is behind the router, and behind the router's firewall. If you want more of a firewall locally, something as simple as an EdgeRouter X can get you started easily with this excellent guide: https://github.com/mjp66/Ubiquiti The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever. The cloudflare tunnel app running on you", "context": "", "use_case": "expose home server without open ports", "switched_from": "", "story": "I got hacked: My Hetzner server started mining Monero"}, {"id": 741728608, "item_id": 46358038, "url": "https://news.ycombinator.com/item?id=46358038", "by": "j45", "date": "2025-12-22", "stance": "recommend", "quote": "nothing is open to the public at all", "excerpt": "Exposing ports on home ip: - exposes the port to be available for inbound connections from anyone on the public internet. When we use a web browser, it's outbound first which initiates responses. - with an exposed port, you are that much more at the mercy of your firewalls ability to protect and defend the open port, which becomes more of a consideration. - some people take additional security steps to only allow cer", "context": "", "use_case": "Expose services without open ports", "switched_from": "", "story": "I got hacked: My Hetzner server started mining Monero"}, {"id": 769133264, "item_id": 48070829, "url": "https://news.ycombinator.com/item?id=48070829", "by": "Lord_Zero", "date": "2026-05-08", "stance": "recommend", "quote": "you should consider using cloudflare tunnel", "excerpt": "I would highly recommend not putting your home network at risk and poking holes into it. If you just self host a public site on your home network you should consider using cloudflare tunnel.", "context": "", "use_case": "exposing self-hosted site safely", "switched_from": "", "story": "Hosting a Site on a Raspberry Pi"}]}, {"label": "Free", "summary": "Commenters run sites and apps on it for free, paying only for a domain.", "quotes": [{"id": 785876224, "item_id": 49117264, "url": "https://news.ycombinator.com/item?id=49117264", "by": "giobox", "date": "2026-07-30", "stance": "recommend", "quote": "I use this all the time for personal projects", "excerpt": "> Enable cloud tunnels so you can access your apps on other devices (paid feature) It's not much extra work to do this technique (tunnel to publicly accessible domain name from locally or privately hosted setup) with cloudflare tunnels. It's also completely free, all you need is a domain name managed by cloudflare (~10 bucks a year). You just throw up a cloudflared container (can be part of your local docker compose ", "context": "", "use_case": "expose local apps publicly", "switched_from": "", "story": "Show HN: Port Zero \u2013 how I learned to stop worrying and love PORT=0"}, {"id": 796128128, "item_id": 49758008, "url": "https://news.ycombinator.com/item?id=49758008", "by": "cmacleod4", "date": "2026-09-18", "stance": "recommend", "quote": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now.", "excerpt": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now. The only thing I had to pay for was the DNS registration. There are limits on the traffic you can serve on their free plan, but I'm nowhere near reaching those. I don't know what an SDK would add, you just set up a web server using whatever method suits you, then configure the cloudflared to connect to that. I did ", "context": "self-hosts websites at home", "use_case": "hosting websites from home", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 783412800, "item_id": 48963300, "url": "https://news.ycombinator.com/item?id=48963300", "by": "busymom0", "date": "2026-07-18", "stance": "recommend", "quote": "Only thing I rely upon someone for is Cloudflare tunnels for free. I could replace that with port forwarding but so far, this way is pretty good.", "excerpt": "I self host my site [1] on an old Mac mini in a Swift backend and sqlite database. Only thing I rely upon someone for is Cloudflare tunnels for free. I could replace that with port forwarding but so far, this way is pretty good. [1] https://limereader.com/", "context": "", "use_case": "expose self-hosted site", "switched_from": "", "story": "Hardcore IndieWeb: Run your own website 100% independently for only $0.01/day"}]}, {"label": "Easy setup", "summary": "Setup is described as a couple of clicks or a single cloudflared container.", "quotes": [{"id": 796205841, "item_id": 49762865, "url": "https://news.ycombinator.com/item?id=49762865", "by": "allthetime", "date": "2026-09-19", "stance": "recommend", "quote": "If i want to expose something for friends who don\u2019t use Tailscale I connect a cloudflare tunnel\u2026 it\u2019s pretty much a couple clicks", "excerpt": "I use public dns routed to private Tailscale ips for all my home services. If i want to expose something for friends who don\u2019t use Tailscale I connect a cloudflare tunnel\u2026 it\u2019s pretty much a couple clicks and typing in a subdomain name once cloudflared is running on a server\u2026 what were you having trouble with?", "context": "homelab user", "use_case": "exposing services publicly", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 785876224, "item_id": 49117264, "url": "https://news.ycombinator.com/item?id=49117264", "by": "giobox", "date": "2026-07-30", "stance": "recommend", "quote": "I use this all the time for personal projects", "excerpt": "> Enable cloud tunnels so you can access your apps on other devices (paid feature) It's not much extra work to do this technique (tunnel to publicly accessible domain name from locally or privately hosted setup) with cloudflare tunnels. It's also completely free, all you need is a domain name managed by cloudflare (~10 bucks a year). You just throw up a cloudflared container (can be part of your local docker compose ", "context": "", "use_case": "expose local apps publicly", "switched_from": "", "story": "Show HN: Port Zero \u2013 how I learned to stop worrying and love PORT=0"}, {"id": 763975168, "item_id": 47748448, "url": "https://news.ycombinator.com/item?id=47748448", "by": "antihero", "date": "2026-04-12", "stance": "recommend", "quote": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi.", "excerpt": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi. Interestingly, in the early hours of this morning I switched from Cloudflare Tunnels to a rathole/traefik based solution (well, currently it's port forwarding and a low grade home-baked dyndns solution until I get paid and can afford a cheap hetzner box because I spent all of my money again). I switched back because I ", "context": "", "use_case": "", "switched_from": "", "story": "State of Homelab 2026"}]}, {"label": "Works reliably", "summary": "Users report it working very well for years, including in production.", "quotes": [{"id": 796128128, "item_id": 49758008, "url": "https://news.ycombinator.com/item?id=49758008", "by": "cmacleod4", "date": "2026-09-18", "stance": "recommend", "quote": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now.", "excerpt": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now. The only thing I had to pay for was the DNS registration. There are limits on the traffic you can serve on their free plan, but I'm nowhere near reaching those. I don't know what an SDK would add, you just set up a web server using whatever method suits you, then configure the cloudflared to connect to that. I did ", "context": "self-hosts websites at home", "use_case": "hosting websites from home", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796174672, "item_id": 49760917, "url": "https://news.ycombinator.com/item?id=49760917", "by": "JeremyJaydan", "date": "2026-09-18", "stance": "recommend", "quote": "I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes.", "excerpt": "I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes. It's nice to see a simpler version even if it's just for testing.", "context": "", "use_case": "production tunneling", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796173184, "item_id": 49760824, "url": "https://news.ycombinator.com/item?id=49760824", "by": "girvo", "date": "2026-09-18", "stance": "recommend", "quote": "I rely on normal Cloudflare Tunnels for my self-hosted website/web apps, works shockingly well", "excerpt": "This is super neat! I rely on normal Cloudflare Tunnels for my self-hosted website/web apps, works shockingly well all things considered. It was pretty easy to setup\u2026 but I cheated, and use Dokploy which handled most of it AFAICT", "context": "", "use_case": "expose self-hosted web apps", "switched_from": "", "story": "Cloudflare Quick Tunnels"}]}, {"label": "Security extras", "summary": "Adds DDoS and abuse protection and pairs with Zero Trust login or GitHub SSO.", "quotes": [{"id": 767242544, "item_id": 47952659, "url": "https://news.ycombinator.com/item?id=47952659", "by": "nostrademons", "date": "2026-04-29", "stance": "recommend", "quote": "Or just use CloudFlare Tunnel, which gives you a bunch of other DDoS and abuse protection", "excerpt": "Had to Google since it's been almost 20 years since I used nginx directly: https://serverfault.com/questions/1033131/filter-to-only-pass-specific-headers-by-nginx-reverse-proxy Set proxy_pass_request_headers off, and then explicitly proxy_set_header each individual header you want to forward to the variable representing it in nginx config. Or just use CloudFlare Tunnel, which gives you a bunch of other DDoS and abuse", "context": "", "use_case": "exposing app behind reverse proxy", "switched_from": "", "story": "FastCGI: 30 Years Old and Still the Better Protocol for Reverse Proxies"}, {"id": 793012704, "item_id": 49563294, "url": "https://news.ycombinator.com/item?id=49563294", "by": "throwup238", "date": "2026-09-04", "stance": "recommend", "quote": "Cloudflare Tunnels + Zero Trust + Github SSO means securing them is rather easy", "excerpt": "I use MCP for two types of things: ones where I need to give access to the memory of the process like an MCP server to inspect a Qt gui, and ones where I need to give authenticated access to my data to ChatGPT/Claude web/mobile apps. For these uses CLIs would be too cumbersome in use or auth. For the latter, Cloudflare Tunnels + Zero Trust + Github SSO means securing them is rather easy and with the recent cf cli the", "context": "", "use_case": "securing MCP servers", "switched_from": "", "story": "Ask HN: Who is using MCP in production?"}, {"id": 801911619, "item_id": 50119476, "url": "https://news.ycombinator.com/item?id=50119476", "by": "Hikikomori", "date": "2026-10-16", "stance": "recommend", "quote": "expose services with Cloudflared tunnel if you have your own domain, I use cloudflare zero trust just to avoid exposing the service directly", "excerpt": "I would install latest ubuntu server. I use dockge that provides a simple web interface to manage docker compose files, most projects provide a ready to use compose file that you can copy paste. Then you can use tailscale for remote access, expose to the internet via your router, or expose services with Cloudflared tunnel if you have your own domain, I use cloudflare zero trust just to avoid exposing the service dire", "context": "", "use_case": "exposing services without opening ports", "switched_from": "", "story": "What I self-host"}]}, {"label": "Handles HTTPS", "summary": "Cloudflare takes care of TLS termination and certificates.", "quotes": [{"id": 771493824, "item_id": 48218364, "url": "https://news.ycombinator.com/item?id=48218364", "by": "tehlike", "date": "2026-05-20", "stance": "recommend", "quote": "Works out decently, and CF takes care of the SSL bits.", "excerpt": "I use cloudflare tunnel to expose local services to internet. Works out decently, and CF takes care of the SSL bits.", "context": "", "use_case": "exposing local services", "switched_from": "", "story": "Anyone on the Internet Can Ring Your Doorbell"}, {"id": 763975168, "item_id": 47748448, "url": "https://news.ycombinator.com/item?id=47748448", "by": "antihero", "date": "2026-04-12", "stance": "recommend", "quote": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi.", "excerpt": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi. Interestingly, in the early hours of this morning I switched from Cloudflare Tunnels to a rathole/traefik based solution (well, currently it's port forwarding and a low grade home-baked dyndns solution until I get paid and can afford a cheap hetzner box because I spent all of my money again). I switched back because I ", "context": "", "use_case": "", "switched_from": "", "story": "State of Homelab 2026"}]}], "caveats": [{"label": "Config pain", "summary": "Configuration can be a pain, and the dashboard lacks options or was broken for some.", "quotes": [{"id": 796174672, "item_id": 49760917, "url": "https://news.ycombinator.com/item?id=49760917", "by": "JeremyJaydan", "date": "2026-09-18", "stance": "recommend", "quote": "I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes.", "excerpt": "I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes. It's nice to see a simpler version even if it's just for testing.", "context": "", "use_case": "production tunneling", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796128128, "item_id": 49758008, "url": "https://news.ycombinator.com/item?id=49758008", "by": "cmacleod4", "date": "2026-09-18", "stance": "recommend", "quote": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now.", "excerpt": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now. The only thing I had to pay for was the DNS registration. There are limits on the traffic you can serve on their free plan, but I'm nowhere near reaching those. I don't know what an SDK would add, you just set up a web server using whatever method suits you, then configure the cloudflared to connect to that. I did ", "context": "self-hosts websites at home", "use_case": "hosting websites from home", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796111761, "item_id": 49756985, "url": "https://news.ycombinator.com/item?id=49756985", "by": "TIPSIO", "date": "2026-09-18", "stance": "warn", "quote": "between the broken dashboard side of Zero Trust and nightmare of Warp\u2026 it was basically impossible to setup.", "excerpt": "My wife and I have a mobile group/shared bot system where we can make mini apps and collab. Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc\u2026 We have Tailscale on our phones and can instantly and privately see without deployment or anything crazy via our secure VPN. Think shared Claude Artifacts that don\u2019t live @ Anthropic. Tried to first do this with Cloud", "context": "", "use_case": "private access to mini apps", "switched_from": "", "story": "Cloudflare Quick Tunnels"}]}, {"label": "Usage limits", "summary": "Requests above 100MiB are blocked, and the free plan has traffic limits.", "quotes": [{"id": 780317392, "item_id": 48769837, "url": "https://news.ycombinator.com/item?id=48769837", "by": "1una", "date": "2026-07-02", "stance": "warn", "quote": "Cloudflare Tunnel blocks requests above 100MiB", "excerpt": "Note that Cloudflare Tunnel blocks requests above 100MiB, which makes it impossible to upload long videos. This is being addressed in https://github.com/immich-app/immich/pull/22385", "context": "", "use_case": "", "switched_from": "", "story": "Immich v3.0.0 Released"}, {"id": 796128128, "item_id": 49758008, "url": "https://news.ycombinator.com/item?id=49758008", "by": "cmacleod4", "date": "2026-09-18", "stance": "recommend", "quote": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now.", "excerpt": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now. The only thing I had to pay for was the DNS registration. There are limits on the traffic you can serve on their free plan, but I'm nowhere near reaching those. I don't know what an SDK would add, you just set up a web server using whatever method suits you, then configure the cloudflared to connect to that. I did ", "context": "self-hosts websites at home", "use_case": "hosting websites from home", "switched_from": "", "story": "Cloudflare Quick Tunnels"}]}, {"label": "Media streaming", "summary": "Streaming media is described as against the terms of service.", "quotes": [{"id": 763964096, "item_id": 47747756, "url": "https://news.ycombinator.com/item?id=47747756", "by": "AdrienPoupa", "date": "2026-04-12", "stance": "warn", "quote": "you should not use Cloudflare Tunnels to stream media", "excerpt": "This is very cool, but you should not use Cloudflare Tunnels to stream media. This is forbidden by their terms of service (or at the very least not the intended use of Tunnels and they may disable your service). Use Wireguard or Tailscale instead. https://www.xda-developers.com/cloudflare-tunnels-are-great-but-never-use-them-for-media-streaming/", "context": "", "use_case": "Exposing local services", "switched_from": "", "story": "State of Homelab 2026"}, {"id": 763975168, "item_id": 47748448, "url": "https://news.ycombinator.com/item?id=47748448", "by": "antihero", "date": "2026-04-12", "stance": "recommend", "quote": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi.", "excerpt": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi. Interestingly, in the early hours of this morning I switched from Cloudflare Tunnels to a rathole/traefik based solution (well, currently it's port forwarding and a low grade home-baked dyndns solution until I get paid and can afford a cheap hetzner box because I spent all of my money again). I switched back because I ", "context": "", "use_case": "", "switched_from": "", "story": "State of Homelab 2026"}]}, {"label": "Cloudflare sees traffic", "summary": "Cloudflare terminates TLS and can see traffic in plaintext.", "quotes": [{"id": 792634913, "item_id": 49539682, "url": "https://news.ycombinator.com/item?id=49539682", "by": "smalex-z", "date": "2026-09-02", "stance": "warn", "quote": "letting Cloudflare terminate your TLS and see every byte of our traffic in plaintext", "excerpt": "Gopher is a self-hosted, open-source version of Cloudflare Tunnel. It turns one public IP into as many as 65k public services by using L4 tunnels from your machines to the edge, rather than traditional L3 routing. photos.yourdomain.com \u2192 router.yourdomain.com:1024 \u2192Immich on home NAS (192.168.1.50:2283) lab.yourdomain.com \u2192 router.yourdomain.com:1025 \u2192 Jupyter on uni wifi (10.0.10.34:8888) vault.yourdomain.com \u2192 rout", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Gopher \u2013 open-source self-hosted Cloudflare Tunnel alternative"}]}, {"label": "CPU usage", "summary": "On a high-traffic site the daemon used a sizeable amount of CPU.", "quotes": [{"id": 793727872, "item_id": 49607992, "url": "https://news.ycombinator.com/item?id=49607992", "by": "CommanderData", "date": "2026-09-08", "stance": "warn", "quote": "the daemon uses a sizeable amount of CPU", "excerpt": "What I was talking about: https://newtrackon.com/ 10+ BT trackers using CF likely free tier. Low-end EACH 300-500 MILLION HTTP requests/24hr uncached, some exceed a billion reqs/day (using statistics from other open trackers) 20TB-40TB daily, ~1-3 Gbps sustained. That's a crap load of transfer and compute to process those tiny network connections. As someone that's run a Tunnel on a normal site in the millions, the d", "context": "", "use_case": "", "switched_from": "", "story": "Among European Companies That Use a CDN, Nearly 9 in 10 Use Cloudflare"}]}, {"label": "Not full security", "summary": "It reduces exposure but is not a complete security layer.", "quotes": [{"id": 780314672, "item_id": 48769667, "url": "https://news.ycombinator.com/item?id=48769667", "by": "Grombobulous", "date": "2026-07-02", "stance": "recommend", "quote": "Cloudflare Tunnel is a really fantastic product", "excerpt": "If you are okay with internet exposure on some level, Cloudflare Tunnel is a really fantastic product: https://developers.cloudflare.com/tunnel/ It\u2019s obviously not a magical security layer that eliminates all issues related to public Internet exposure, but in my opinion it is good enough for the average home user.", "context": "", "use_case": "exposing home services to internet", "switched_from": "", "story": "Immich v3.0.0 Released"}]}], "who": [{"by": "wraptile", "context": "self-hosts on refurbished laptops", "url": "https://news.ycombinator.com/item?id=50017667", "date": "2026-10-09"}, {"by": "monk_grilla", "context": "self-hoster with modest uptime needs", "url": "https://news.ycombinator.com/item?id=50016139", "date": "2026-10-09"}, {"by": "Imustaskforhelp", "context": "18-year-old developer", "url": "https://news.ycombinator.com/item?id=49981023", "date": "2026-10-06"}, {"by": "allthetime", "context": "homelab user", "url": "https://news.ycombinator.com/item?id=49762865", "date": "2026-09-19"}, {"by": "cmacleod4", "context": "self-hosts websites at home", "url": "https://news.ycombinator.com/item?id=49758008", "date": "2026-09-18"}, {"by": "MerrimanInd", "context": "self-hosts knot, PDS and spindle", "url": "https://news.ycombinator.com/item?id=49353851", "date": "2026-08-18"}, {"by": "onetrickwolf", "context": "self-hosts a website", "url": "https://news.ycombinator.com/item?id=48963701", "date": "2026-07-18"}, {"by": "arjie", "context": "homelabber", "url": "https://news.ycombinator.com/item?id=47747585", "date": "2026-04-12"}, {"by": "yoctosec", "context": "self-hoster on a Raspberry Pi", "url": "https://news.ycombinator.com/item?id=46158392", "date": "2025-12-05"}, {"by": "saltywhistle", "context": "hosts small projects on a home server in the UK", "url": "https://news.ycombinator.com/item?id=45967442", "date": "2025-11-18"}, {"by": "youngbum", "context": "team using Windows workstations", "url": "https://news.ycombinator.com/item?id=45960259", "date": "2025-11-17"}], "tags": ["for homelabbers", "for hosting sites at home", "for servers without a public IP", "pairs with Tailscale"], "use_cases": ["exposing local services", "exposing self-hosted server", "remote access to self-hosted", "exposing services without opening ports", "exposing public web apps", "exposing services to internet"], "compared": [{"slug": "tailscale", "name": "Tailscale", "co": 13, "switched_from": 0, "switched_to": 0}, {"slug": "claude-code", "name": "Claude Code", "co": 6, "switched_from": 0, "switched_to": 0}, {"slug": "wireguard", "name": "WireGuard", "co": 6, "switched_from": 0, "switched_to": 0}, {"slug": "caddy", "name": "Caddy", "co": 6, "switched_from": 0, "switched_to": 0}, {"slug": "podman", "name": "Podman", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "immich", "name": "Immich", "co": 3, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49754785", "title": "Cloudflare Quick Tunnels", "mentions": 8}, {"url": "https://news.ycombinator.com/item?id=47746577", "title": "State of Homelab 2026", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=49985548", "title": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=46305585", "title": "I got hacked: My Hetzner server started mining Monero", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=45946865", "title": "I finally understand Cloudflare Zero Trust tunnels", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=48962758", "title": "Hardcore IndieWeb: Run your own website 100% independently for only $0.01/day", "mentions": 2}], "sentiment_by_month": {"2025-11": {"warn": 1, "neutral": 4, "recommend": 4}, "2025-12": {"warn": 1, "neutral": 1, "recommend": 3}, "2026-01": {"neutral": 3, "compare": 1, "recommend": 2}, "2026-02": {"neutral": 1}, "2026-03": {"recommend": 2, "neutral": 1}, "2026-04": {"recommend": 4, "warn": 1, "compare": 1, "neutral": 2}, "2026-05": {"recommend": 2}, "2026-06": {"neutral": 4}, "2026-07": {"recommend": 4, "warn": 1, "neutral": 1}, "2026-08": {"neutral": 3, "recommend": 1}, "2026-09": {"warn": 3, "recommend": 6, "compare": 1, "neutral": 1}, "2026-10": {"neutral": 3, "recommend": 3}}, "quotes": [{"id": 803479330, "item_id": 50217458, "url": "https://news.ycombinator.com/item?id=50217458", "by": "privacyishuman", "date": "2026-10-24", "stance": "neutral", "quote": "I use Cloudflare tunnels for convenience.", "excerpt": "If you have your server encrypted at rest, don't you have to manually enter a password or use a hardware key each restart? And then it's not encrypted when running. > If you self host, why does it matter if it is E2E? What's your threat model? I prefer E2EE services because clients like GrapheneOS, iPhones, and Macs are a lot harder to hack than a server. And I use Cloudflare tunnels for convenience. It's also just g", "context": "", "use_case": "remote access to self-hosted", "switched_from": "", "story": "Now Google says it might use your Gmail and Google Photos data to target ads"}, {"id": 801911619, "item_id": 50119476, "url": "https://news.ycombinator.com/item?id=50119476", "by": "Hikikomori", "date": "2026-10-16", "stance": "recommend", "quote": "expose services with Cloudflared tunnel if you have your own domain, I use cloudflare zero trust just to avoid exposing the service directly", "excerpt": "I would install latest ubuntu server. I use dockge that provides a simple web interface to manage docker compose files, most projects provide a ready to use compose file that you can copy paste. Then you can use tailscale for remote access, expose to the internet via your router, or expose services with Cloudflared tunnel if you have your own domain, I use cloudflare zero trust just to avoid exposing the service dire", "context": "", "use_case": "exposing services without opening ports", "switched_from": "", "story": "What I self-host"}, {"id": 800439472, "item_id": 50027467, "url": "https://news.ycombinator.com/item?id=50027467", "by": "Havoc", "date": "2026-10-09", "stance": "neutral", "quote": "it absolutely can't be CF protected / tunneled.", "excerpt": "I usually go for ~2 USD servers because anything more demanding I'd just do off the homelab. So the 2 buck one is just stuff I want on a freestanding IP/system or where it absolutely can't be CF protected / tunneled. e.g. https://tls.obsidian.place - TLS info tool...has to be raw exposed server to work.", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800282673, "item_id": 50017667, "url": "https://news.ycombinator.com/item?id=50017667", "by": "wraptile", "date": "2026-10-09", "stance": "recommend", "quote": "public facing web apps I host through cloudflare tunnels", "excerpt": "These VPS no longer make much sense for self-hosting imo. I have two refurbished 32gb ram Lenovo k14 laptops (250$ each) that I use for self-hosting over tailscale and cloudflare tunnels. This is a lot of compute and very little power use. One for personal self-hosted projects: languagetool, nextcloud, hister, syncthing, restic backups, vaultwarden, windmill. Another for public facing web apps I host through cloudfla", "context": "self-hosts on refurbished laptops", "use_case": "exposing public web apps", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800258224, "item_id": 50016139, "url": "https://news.ycombinator.com/item?id=50016139", "by": "monk_grilla", "date": "2026-10-09", "stance": "recommend", "quote": "I use Cloudflare tunnels for anything I want to expose to the internet, that gives me enough peace of mind", "excerpt": "I use Cloudflare tunnels for anything I want to expose to the internet, that gives me enough peace of mind, though I understand a VPS would be the least-risk and highest-uptime option, my risk profile and uptime requirements don't make it necessary.", "context": "self-hoster with modest uptime needs", "use_case": "exposing services to internet", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 799696371, "item_id": 49981023, "url": "https://news.ycombinator.com/item?id=49981023", "by": "Imustaskforhelp", "date": "2026-10-06", "stance": "neutral", "quote": "use cf tunnels in the middle", "excerpt": "(I am currently 18 so you have actually been coding since more than two times my whole lifetime so y'know there's that.) I wish to ask you for some feedback and clarity and further concrete resources because I feel a little confused/lost regarding the whole vibe-coding situation, I wish to say thanks in general though as nonetheless your comment finally made me concretely express all the nuances brewing in my stomach", "context": "18-year-old developer", "use_case": "exposing small servers", "switched_from": "", "story": "Vibecoding isn't as fun as writing code by hand"}, {"id": 796255440, "item_id": 49765965, "url": "https://news.ycombinator.com/item?id=49765965", "by": "peter_retief", "date": "2026-09-19", "stance": "recommend", "quote": "I have been using CF tunnels for quite some time, very useful", "excerpt": "I have been using CF tunnels for quite some time, very useful if you want to ingest mail on a local server without a public IP and hosting anything locally. They are providing this for free up to a point, I wonder if all developers are aware of this amazing offering?", "context": "", "use_case": "ingest mail on local server", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796205841, "item_id": 49762865, "url": "https://news.ycombinator.com/item?id=49762865", "by": "allthetime", "date": "2026-09-19", "stance": "recommend", "quote": "If i want to expose something for friends who don\u2019t use Tailscale I connect a cloudflare tunnel\u2026 it\u2019s pretty much a couple clicks", "excerpt": "I use public dns routed to private Tailscale ips for all my home services. If i want to expose something for friends who don\u2019t use Tailscale I connect a cloudflare tunnel\u2026 it\u2019s pretty much a couple clicks and typing in a subdomain name once cloudflared is running on a server\u2026 what were you having trouble with?", "context": "homelab user", "use_case": "exposing services publicly", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796174672, "item_id": 49760917, "url": "https://news.ycombinator.com/item?id=49760917", "by": "JeremyJaydan", "date": "2026-09-18", "stance": "recommend", "quote": "I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes.", "excerpt": "I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes. It's nice to see a simpler version even if it's just for testing.", "context": "", "use_case": "production tunneling", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796173184, "item_id": 49760824, "url": "https://news.ycombinator.com/item?id=49760824", "by": "girvo", "date": "2026-09-18", "stance": "recommend", "quote": "I rely on normal Cloudflare Tunnels for my self-hosted website/web apps, works shockingly well", "excerpt": "This is super neat! I rely on normal Cloudflare Tunnels for my self-hosted website/web apps, works shockingly well all things considered. It was pretty easy to setup\u2026 but I cheated, and use Dokploy which handled most of it AFAICT", "context": "", "use_case": "expose self-hosted web apps", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796161729, "item_id": 49760108, "url": "https://news.ycombinator.com/item?id=49760108", "by": "dalberto", "date": "2026-09-18", "stance": "neutral", "quote": "using Cloudflare Tunnels", "excerpt": "I built something for this exact use-case using Cloudflare Tunnels: https://github.com/dalberto/mcp-ferry I also use CF managed auth to make auth easier.", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796128128, "item_id": 49758008, "url": "https://news.ycombinator.com/item?id=49758008", "by": "cmacleod4", "date": "2026-09-18", "stance": "recommend", "quote": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now.", "excerpt": "I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now. The only thing I had to pay for was the DNS registration. There are limits on the traffic you can serve on their free plan, but I'm nowhere near reaching those. I don't know what an SDK would add, you just set up a web server using whatever method suits you, then configure the cloudflared to connect to that. I did ", "context": "self-hosts websites at home", "use_case": "hosting websites from home", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796126385, "item_id": 49757899, "url": "https://news.ycombinator.com/item?id=49757899", "by": "SparkyMcUnicorn", "date": "2026-09-18", "stance": "compare", "quote": "similar to these cloudflare tunnels", "excerpt": "> You can also use Tailscale serve to get a HTTPS url like Cloudflared but it's only visible to your tailnet For public access, similar to these cloudflare tunnels, there's Tailscale Funnel. https://tailscale.com/docs/features/tailscale-funnel", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796111761, "item_id": 49756985, "url": "https://news.ycombinator.com/item?id=49756985", "by": "TIPSIO", "date": "2026-09-18", "stance": "warn", "quote": "between the broken dashboard side of Zero Trust and nightmare of Warp\u2026 it was basically impossible to setup.", "excerpt": "My wife and I have a mobile group/shared bot system where we can make mini apps and collab. Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc\u2026 We have Tailscale on our phones and can instantly and privately see without deployment or anything crazy via our secure VPN. Think shared Claude Artifacts that don\u2019t live @ Anthropic. Tried to first do this with Cloud", "context": "", "use_case": "private access to mini apps", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 793727872, "item_id": 49607992, "url": "https://news.ycombinator.com/item?id=49607992", "by": "CommanderData", "date": "2026-09-08", "stance": "warn", "quote": "the daemon uses a sizeable amount of CPU", "excerpt": "What I was talking about: https://newtrackon.com/ 10+ BT trackers using CF likely free tier. Low-end EACH 300-500 MILLION HTTP requests/24hr uncached, some exceed a billion reqs/day (using statistics from other open trackers) 20TB-40TB daily, ~1-3 Gbps sustained. That's a crap load of transfer and compute to process those tiny network connections. As someone that's run a Tunnel on a normal site in the millions, the d", "context": "", "use_case": "", "switched_from": "", "story": "Among European Companies That Use a CDN, Nearly 9 in 10 Use Cloudflare"}, {"id": 793012704, "item_id": 49563294, "url": "https://news.ycombinator.com/item?id=49563294", "by": "throwup238", "date": "2026-09-04", "stance": "recommend", "quote": "Cloudflare Tunnels + Zero Trust + Github SSO means securing them is rather easy", "excerpt": "I use MCP for two types of things: ones where I need to give access to the memory of the process like an MCP server to inspect a Qt gui, and ones where I need to give authenticated access to my data to ChatGPT/Claude web/mobile apps. For these uses CLIs would be too cumbersome in use or auth. For the latter, Cloudflare Tunnels + Zero Trust + Github SSO means securing them is rather easy and with the recent cf cli the", "context": "", "use_case": "securing MCP servers", "switched_from": "", "story": "Ask HN: Who is using MCP in production?"}, {"id": 792634913, "item_id": 49539682, "url": "https://news.ycombinator.com/item?id=49539682", "by": "smalex-z", "date": "2026-09-02", "stance": "warn", "quote": "letting Cloudflare terminate your TLS and see every byte of our traffic in plaintext", "excerpt": "Gopher is a self-hosted, open-source version of Cloudflare Tunnel. It turns one public IP into as many as 65k public services by using L4 tunnels from your machines to the edge, rather than traditional L3 routing. photos.yourdomain.com \u2192 router.yourdomain.com:1024 \u2192Immich on home NAS (192.168.1.50:2283) lab.yourdomain.com \u2192 router.yourdomain.com:1025 \u2192 Jupyter on uni wifi (10.0.10.34:8888) vault.yourdomain.com \u2192 rout", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Gopher \u2013 open-source self-hosted Cloudflare Tunnel alternative"}, {"id": 790330448, "item_id": 49395653, "url": "https://news.ycombinator.com/item?id=49395653", "by": "simondanerd", "date": "2026-08-22", "stance": "recommend", "quote": "Cloudflare tunnels for stuff requiring an actual machine.", "excerpt": "Cloudflare tunnels for stuff requiring an actual machine. Cloudflare or Netlify Pages for static projects (with D1 as a database when needed).", "context": "", "use_case": "hosting vibe coded tools", "switched_from": "", "story": "Ask HN: How do you host your vibe coded tools/sites?"}, {"id": 789661617, "item_id": 49353851, "url": "https://news.ycombinator.com/item?id=49353851", "by": "MerrimanInd", "date": "2026-08-18", "stance": "neutral", "quote": "In my case that's routed through a Cloudflare tunnel to a reverse proxy running on my server.", "excerpt": "I'm not an AT Proto wizard (there's a lot of good text and video explainers out there) and I know that Tangled is building on it but also adding their own functionality. But from a high level, I register my 'knot' with my account on Tangled.org which is exposed through a public domain. In my case that's routed through a Cloudflare tunnel to a reverse proxy running on my server. Tangled is then running an \"app view\", ", "context": "self-hosts knot, PDS and spindle", "use_case": "exposing self-hosted server", "switched_from": "", "story": "Ask HN: Alternatives to GitHub"}, {"id": 789173328, "item_id": 49323333, "url": "https://news.ycombinator.com/item?id=49323333", "by": "monitorion", "date": "2026-08-16", "stance": "neutral", "quote": "We use Cloudflare tunnels for connecting distributed workers to central infrastructure.", "excerpt": "We use Cloudflare tunnels for connecting distributed workers to central infrastructure. Haven't seen this on tunnel traffic, but good to know it happens on nameserver-managed sites. Another reason to audit what your CDN injects \u2014 same applies to checking your security headers regularly.", "context": "", "use_case": "connecting distributed workers", "switched_from": "", "story": "Tell HN: Cloudflare silently injects its analytics when you switch nameservers"}, {"id": 787338802, "item_id": 49208675, "url": "https://news.ycombinator.com/item?id=49208675", "by": "mikeayles", "date": "2026-08-07", "stance": "neutral", "quote": "which has a cloudflare tunnel to the real world", "excerpt": "I'm using the AMD (Xilinx) K26. It's a Zynq Ultrascale+, the successor to the old classic 7000's. I'm running it on the KV260 dev board, because I'm using it for another side project. The K26 has a quad core A53 core alongside the programmable logic (PL, or Fabric). The A53 is pretty weak, and doesn't have any hardware matmul operations, so despite the KV260 being sold as a 'vision ai starter kit' and the vitis objec", "context": "", "use_case": "Exposing a live demo", "switched_from": "", "story": "AMD acquires Taalas to boost inference performance by etching models in silicon"}, {"id": 785876224, "item_id": 49117264, "url": "https://news.ycombinator.com/item?id=49117264", "by": "giobox", "date": "2026-07-30", "stance": "recommend", "quote": "I use this all the time for personal projects", "excerpt": "> Enable cloud tunnels so you can access your apps on other devices (paid feature) It's not much extra work to do this technique (tunnel to publicly accessible domain name from locally or privately hosted setup) with cloudflare tunnels. It's also completely free, all you need is a domain name managed by cloudflare (~10 bucks a year). You just throw up a cloudflared container (can be part of your local docker compose ", "context": "", "use_case": "expose local apps publicly", "switched_from": "", "story": "Show HN: Port Zero \u2013 how I learned to stop worrying and love PORT=0"}, {"id": 783419216, "item_id": 48963701, "url": "https://news.ycombinator.com/item?id=48963701", "by": "onetrickwolf", "date": "2026-07-18", "stance": "neutral", "quote": "I use Cloudflare tunnels too but also their CDN which is free (for now).", "excerpt": "I have something similar. I use Cloudflare tunnels too but also their CDN which is free (for now). That's the only thing I haven't really been able to figure out how to do on my own. Back in the day, hosting a static site from my crappy DSL connection was basically no problem and most people who were accessing my site were probably in my timezone. Now with how big the web is and how many bots there are, I worry about", "context": "self-hosts a website", "use_case": "self-hosted site exposure", "switched_from": "", "story": "Hardcore IndieWeb: Run your own website 100% independently for only $0.01/day"}, {"id": 783412800, "item_id": 48963300, "url": "https://news.ycombinator.com/item?id=48963300", "by": "busymom0", "date": "2026-07-18", "stance": "recommend", "quote": "Only thing I rely upon someone for is Cloudflare tunnels for free. I could replace that with port forwarding but so far, this way is pretty good.", "excerpt": "I self host my site [1] on an old Mac mini in a Swift backend and sqlite database. Only thing I rely upon someone for is Cloudflare tunnels for free. I could replace that with port forwarding but so far, this way is pretty good. [1] https://limereader.com/", "context": "", "use_case": "expose self-hosted site", "switched_from": "", "story": "Hardcore IndieWeb: Run your own website 100% independently for only $0.01/day"}, {"id": 780797616, "item_id": 48799851, "url": "https://news.ycombinator.com/item?id=48799851", "by": "Imustaskforhelp", "date": "2026-07-05", "stance": "recommend", "quote": "I appreciate cloudflare as a product myself and actively use cf tunnels", "excerpt": "Sorry kentonv! , I apologize :-( I had mistakenly written 500 million when it was around 5 million dollars so I messed up its 5 million per month[See Source], not 500 million. I wish to have a genuine discussion while you are here though because i can be wrong, I usually am and I would love to have a good faith discussion, thanks in advance! I will try to back up a lot of it with hackernews comments from the thread w", "context": "", "use_case": "Network tunneling", "switched_from": "", "story": "Mark Zuckerberg tells staff that AI agents haven't progressed enough"}, {"id": 780317392, "item_id": 48769837, "url": "https://news.ycombinator.com/item?id=48769837", "by": "1una", "date": "2026-07-02", "stance": "warn", "quote": "Cloudflare Tunnel blocks requests above 100MiB", "excerpt": "Note that Cloudflare Tunnel blocks requests above 100MiB, which makes it impossible to upload long videos. This is being addressed in https://github.com/immich-app/immich/pull/22385", "context": "", "use_case": "", "switched_from": "", "story": "Immich v3.0.0 Released"}, {"id": 780314672, "item_id": 48769667, "url": "https://news.ycombinator.com/item?id=48769667", "by": "Grombobulous", "date": "2026-07-02", "stance": "recommend", "quote": "Cloudflare Tunnel is a really fantastic product", "excerpt": "If you are okay with internet exposure on some level, Cloudflare Tunnel is a really fantastic product: https://developers.cloudflare.com/tunnel/ It\u2019s obviously not a magical security layer that eliminates all issues related to public Internet exposure, but in my opinion it is good enough for the average home user.", "context": "", "use_case": "exposing home services to internet", "switched_from": "", "story": "Immich v3.0.0 Released"}, {"id": 778528736, "item_id": 48658046, "url": "https://news.ycombinator.com/item?id=48658046", "by": "Imustaskforhelp", "date": "2026-06-24", "stance": "neutral", "quote": "I use cloudflare tunnels in front of my vps to prevent DDOS", "excerpt": "If you want very small servers: either get a 7$/yr vps or (upcloud if all you want is 1gb ram/1core esq server for very lightweight purposes) The thing after Hetzner's price increase is that there isn't one size fits all anymore and I guess it might not impact people like me who knows in my opinion, many providers but in this situation its a net loss for many who might be paying higher prices. So here is my small lis", "context": "", "use_case": "DDoS protection for VPS", "switched_from": "", "story": "We're making Bunny DNS free: because a faster internet won't build itself"}, {"id": 778263905, "item_id": 48641494, "url": "https://news.ycombinator.com/item?id=48641494", "by": "insin", "date": "2026-06-23", "stance": "neutral", "quote": "which I can expose to them via Cloudflare Tunnel", "excerpt": "I'm using this API in the internal [1] model-independent LLM chat app I work on at an F100, and it ruined using the Claude and ChatGPT web interfaces for me outside of work [2] because I'm used to being able to point the model at a folder so it can be directed to find and pull in relevant context itself, being able to add folder mid-chat and saying \"you do it\", and being able to have the model run code to work with l", "context": "", "use_case": "exposing local MCP server", "switched_from": "", "story": "window.showDirectoryPicker opens up a whole new world"}, {"id": 775169203, "item_id": 48448075, "url": "https://news.ycombinator.com/item?id=48448075", "by": "tstrimple", "date": "2026-06-08", "stance": "neutral", "quote": "I use cloudflared tunnels to selectively make them public", "excerpt": "Don't make the mistake of thinking CI/CD is more complicated than it is. It's just automated compilation & testing plus automated deployment. The jargon can be overwhelming. You can do this with forgejo actions. I'm also using self-hosted forgejo and I generated a token for CC to use to manage and setup everything for me. When code is checked in, it tries to compile it to make sure there are no fundamental issues bui", "context": "", "use_case": "exposing apps publicly", "switched_from": "", "story": "Ask HN: What is the AI setup for an experienced dev starting on a new project?"}, {"id": 774402545, "item_id": 48400159, "url": "https://news.ycombinator.com/item?id=48400159", "by": "srichard16", "date": "2026-06-04", "stance": "neutral", "quote": "Cloudflare has a tunnel product, if you're already using their DNS.", "excerpt": "I think this is the most popular GH: https://github.com/anderspitman/awesome-tunneling. There are tunneling tools written in Go, Rust, Python, Node, PHP, Java, .NET, and C. Some use SSH, some WireGuard, some WebSockets, some QUIC, some roll their own protocol. Many are single-maintainer projects with bursts of commits followed by silence. ngrok owns the space, allows you to actually put protections in place for your ", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What are all the ways to punch through NAT?"}, {"id": 771493824, "item_id": 48218364, "url": "https://news.ycombinator.com/item?id=48218364", "by": "tehlike", "date": "2026-05-20", "stance": "recommend", "quote": "Works out decently, and CF takes care of the SSL bits.", "excerpt": "I use cloudflare tunnel to expose local services to internet. Works out decently, and CF takes care of the SSL bits.", "context": "", "use_case": "exposing local services", "switched_from": "", "story": "Anyone on the Internet Can Ring Your Doorbell"}, {"id": 769133264, "item_id": 48070829, "url": "https://news.ycombinator.com/item?id=48070829", "by": "Lord_Zero", "date": "2026-05-08", "stance": "recommend", "quote": "you should consider using cloudflare tunnel", "excerpt": "I would highly recommend not putting your home network at risk and poking holes into it. If you just self host a public site on your home network you should consider using cloudflare tunnel.", "context": "", "use_case": "exposing self-hosted site safely", "switched_from": "", "story": "Hosting a Site on a Raspberry Pi"}, {"id": 767546000, "item_id": 47971625, "url": "https://news.ycombinator.com/item?id=47971625", "by": "hboon", "date": "2026-04-30", "stance": "neutral", "quote": "I use Cloudflare Tunnel so most of the products I build are exposed and listed there.", "excerpt": "I use Cloudflare Tunnel so most of the products I build are exposed and listed there. I just add comments for those that aren't exposed (eg. browser extension dev port) to that file too. A single doc means coding agents know to look there and keep it updated too.", "context": "", "use_case": "exposing local services", "switched_from": "", "story": "I Got Sick of Remembering Port Numbers"}, {"id": 767242544, "item_id": 47952659, "url": "https://news.ycombinator.com/item?id=47952659", "by": "nostrademons", "date": "2026-04-29", "stance": "recommend", "quote": "Or just use CloudFlare Tunnel, which gives you a bunch of other DDoS and abuse protection", "excerpt": "Had to Google since it's been almost 20 years since I used nginx directly: https://serverfault.com/questions/1033131/filter-to-only-pass-specific-headers-by-nginx-reverse-proxy Set proxy_pass_request_headers off, and then explicitly proxy_set_header each individual header you want to forward to the variable representing it in nginx config. Or just use CloudFlare Tunnel, which gives you a bunch of other DDoS and abuse", "context": "", "use_case": "exposing app behind reverse proxy", "switched_from": "", "story": "FastCGI: 30 Years Old and Still the Better Protocol for Reverse Proxies"}, {"id": 765705347, "item_id": 47856584, "url": "https://news.ycombinator.com/item?id=47856584", "by": "bezier-curve", "date": "2026-04-21", "stance": "neutral", "quote": "behind a Cloudflare tunnel", "excerpt": "The pro plan does include Opus usage. I've noticed the limits on the web client are a bit higher than through CC, but probably more because of the increased token usage of agentic coding in general. Claude web is actually pretty good for dealing with random projects outside of code. I have a Home Assistant MCP server [1] behind a Cloudflare tunnel exposed to it that makes maintaining automations a lot easier. [1] htt", "context": "", "use_case": "", "switched_from": "", "story": "Claude Code no longer included in Pro tier"}, {"id": 764375880, "item_id": 47773492, "url": "https://news.ycombinator.com/item?id=47773492", "by": "seabrookmx", "date": "2026-04-14", "stance": "recommend", "quote": "it's probably even easier if you use a Cloudflare tunnel", "excerpt": "> home lab Well that's your problem right there. The home labber setups are for experimentation or \"hot rodding\" purposes and they typically way overbuild their solutions. What most people need is an old desktop in a corner somewhere (preferably close to your router so you can get to it with an ethernet cable). It's won't be Grandma proof, but if you're remotely technical you can write a docker compose file that glue", "context": "", "use_case": "", "switched_from": "", "story": "Fuck the Cloud (2009)"}, {"id": 764169600, "item_id": 47760600, "url": "https://news.ycombinator.com/item?id=47760600", "by": "arjie", "date": "2026-04-13", "stance": "neutral", "quote": "exposed via `cloudflared`", "excerpt": "I use them for different purposes. The wiki I linked there is exposed via `cloudflared`. Its purpose is to be public. I can't see myself using Wireguard for that.", "context": "", "use_case": "publicly exposing a wiki", "switched_from": "", "story": "State of Homelab 2026"}, {"id": 763975168, "item_id": 47748448, "url": "https://news.ycombinator.com/item?id=47748448", "by": "antihero", "date": "2026-04-12", "stance": "recommend", "quote": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi.", "excerpt": "It's free and simple and handles HTTPS termination and can be set up easily using terraform/pulumi. Interestingly, in the early hours of this morning I switched from Cloudflare Tunnels to a rathole/traefik based solution (well, currently it's port forwarding and a low grade home-baked dyndns solution until I get paid and can afford a cheap hetzner box because I spent all of my money again). I switched back because I ", "context": "", "use_case": "", "switched_from": "", "story": "State of Homelab 2026"}, {"id": 763969088, "item_id": 47748068, "url": "https://news.ycombinator.com/item?id=47748068", "by": "watermelon0", "date": "2026-04-12", "stance": "compare", "quote": "Cloudflare Tunnel publicly exposes your services, whereas Wireguard/Tailscale are VPNs.", "excerpt": "Cloudflare Tunnel publicly exposes your services, whereas Wireguard/Tailscale are VPNs. Tailscale (but not Headscale) offers Funnel, which is a reverse proxy, but you cannot use it with your own domain. Pangolin is the closest alternative to CF Tunnel, but self-hosted NetBird with reverse proxy functionality can also be used.", "context": "", "use_case": "", "switched_from": "", "story": "State of Homelab 2026"}, {"id": 763964096, "item_id": 47747756, "url": "https://news.ycombinator.com/item?id=47747756", "by": "AdrienPoupa", "date": "2026-04-12", "stance": "warn", "quote": "you should not use Cloudflare Tunnels to stream media", "excerpt": "This is very cool, but you should not use Cloudflare Tunnels to stream media. This is forbidden by their terms of service (or at the very least not the intended use of Tunnels and they may disable your service). Use Wireguard or Tailscale instead. https://www.xda-developers.com/cloudflare-tunnels-are-great-but-never-use-them-for-media-streaming/", "context": "", "use_case": "Exposing local services", "switched_from": "", "story": "State of Homelab 2026"}, {"id": 763961360, "item_id": 47747585, "url": "https://news.ycombinator.com/item?id=47747585", "by": "arjie", "date": "2026-04-12", "stance": "recommend", "quote": "Cloudflare Tunnel is a wonderful thing.", "excerpt": "Cloudflare Tunnel is a wonderful thing. In fact, Cloudflare itself is fantastic for homelabbers because it gives you so much for free. I used to just host direct on my own home IP, but nowadays I find it easier to just `cloudflared`. Don't have to worry about the firewall and any breaches into my network and all of that stuff. I started from a similar place as you and then eventually now my IaaC for my homelab is jus", "context": "homelabber", "use_case": "exposing homelab services", "switched_from": "direct hosting on home IP", "story": "State of Homelab 2026"}, {"id": 755939185, "item_id": 47246199, "url": "https://news.ycombinator.com/item?id=47246199", "by": "carlnewton", "date": "2026-03-04", "stance": "recommend", "quote": "Traffic comes in using a cloudflare tunnel.", "excerpt": "I've just moved away from hosting on AWS to buying a refurbished Dell Optiplex 5060 and installing docker compose on it. Traffic comes in using a cloudflare tunnel. The only costs are electricity (it's very low power and virtually silent) and the domain (if you need one), and I'm thrilled with it.", "context": "", "use_case": "exposing self-hosted server", "switched_from": "", "story": "Ask HN: What's your experience self-hosting in 2026?"}, {"id": 741728608, "item_id": 46358038, "url": "https://news.ycombinator.com/item?id=46358038", "by": "j45", "date": "2025-12-22", "stance": "recommend", "quote": "nothing is open to the public at all", "excerpt": "Exposing ports on home ip: - exposes the port to be available for inbound connections from anyone on the public internet. When we use a web browser, it's outbound first which initiates responses. - with an exposed port, you are that much more at the mercy of your firewalls ability to protect and defend the open port, which becomes more of a consideration. - some people take additional security steps to only allow cer", "context": "", "use_case": "Expose services without open ports", "switched_from": "", "story": "I got hacked: My Hetzner server started mining Monero"}, {"id": 741607712, "item_id": 46350482, "url": "https://news.ycombinator.com/item?id=46350482", "by": "j45", "date": "2025-12-21", "stance": "recommend", "quote": "The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever.", "excerpt": "No such thing as a stupid question. If you plug in a machine at home, it is behind the router, and behind the router's firewall. If you want more of a firewall locally, something as simple as an EdgeRouter X can get you started easily with this excellent guide: https://github.com/mjp66/Ubiquiti The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever. The cloudflare tunnel app running on you", "context": "", "use_case": "expose home server without open ports", "switched_from": "", "story": "I got hacked: My Hetzner server started mining Monero"}]}