Cloudflare Tunnel

Publish FeatherPanel through a Cloudflare Tunnel with the installer, fully automatic with an API key or with a tunnel token, without opening ports.

A Cloudflare Tunnel publishes the panel over HTTPS without opening ports 80 and 443 on the server. cloudflared keeps an outbound connection to Cloudflare and forwards requests for your hostname to http://localhost:4831.

The installer offers two modes when you choose Cloudflare Tunnel as the access method.

Full automatic

You give the installer your Cloudflare account email, your Global API Key and the hostname for the panel. It then:

1. Lists your accounts and asks which one to use if there is more than one.
2. Reuses a tunnel named FeatherPanel or creates one.
3. Creates or updates a proxied CNAME record for the hostname in its zone.
4. Adds an ingress rule hostname -> http://localhost:<panel port> in front of the catch-all http_status:404, keeping rules that already exist.
5. Saves the Cloudflare settings to /var/www/featherpanel/.env, so updates and uninstall can find the tunnel again.

Semi-automatic

Create the tunnel yourself in the Cloudflare Zero Trust dashboard, add a public hostname that points at http://localhost:4831, and paste the tunnel token into the installer.

How cloudflared runs

In both modes the installer installs cloudflared from Cloudflare’s APT repository and registers it with cloudflared service install <token>, so it runs as a systemd service and starts on boot. It does not run in a container.

systemctl status cloudflared
journalctl -u cloudflared -f

When you uninstall the panel with the installer, it stops and disables cloudflared, removes tunnel containers left over from older Docker-based installs and, for full automatic setups, deletes the DNS record and the tunnel through the API. See Uninstall.