# Cloudflare Tunnel

> Publish FeatherPanel through a Cloudflare Tunnel with the installer, fully automatic with an API key or with a tunnel token, without opening ports.

Source: https://featherpanel.com/docs/panel/web-server/cloudflare-tunnel/

A Cloudflare Tunnel publishes the panel over HTTPS without opening ports 80 and 443 on the server. `cloudflared` keeps an
outbound connection to Cloudflare and forwards requests for your hostname to `http://localhost:4831`.

The installer offers two modes when you choose Cloudflare Tunnel as the access method.

## Full automatic

You give the installer your Cloudflare account email, your Global API Key and the hostname for the panel. It then:

1. Lists your accounts and asks which one to use if there is more than one.
2. Reuses a tunnel named `FeatherPanel` or creates one.
3. Creates or updates a proxied `CNAME` record for the hostname in its zone.
4. Adds an ingress rule `hostname -> http://localhost:<panel port>` in front of the catch-all `http_status:404`, keeping
   rules that already exist.
5. Saves the Cloudflare settings to `/var/www/featherpanel/.env`, so updates and uninstall can find the tunnel again.

## Semi-automatic

Create the tunnel yourself in the Cloudflare Zero Trust dashboard, add a public hostname that points at
`http://localhost:4831`, and paste the tunnel token into the installer.

## How cloudflared runs

In both modes the installer installs `cloudflared` from Cloudflare's APT repository and registers it with
`cloudflared service install <token>`, so it runs as a systemd service and starts on boot. It does not run in a container.

```bash
systemctl status cloudflared
journalctl -u cloudflared -f
```

When you uninstall the panel with the installer, it stops and disables `cloudflared`, removes tunnel containers left over
from older Docker-based installs and, for full automatic setups, deletes the DNS record and the tunnel through the API.
See [Uninstall](https://featherpanel.com/docs/panel/uninstall).