Cloudflare Tunnel can publish an Umbrel-hosted web app without forwarding an inbound router port. The connector makes an outbound connection to Cloudflare, and a public hostname routes through that tunnel to the app.
That convenience changes the app's threat boundary. A public hostname is public unless you add Cloudflare Access or the application has strong authentication. Do not expose a Bitcoin wallet, node administration panel, seed tool, or another sensitive service merely because the tunnel works.
The reliable mental model
Traffic follows this path:
browser → Cloudflare → cloudflared connector → Umbrel app container
The connector must be able to resolve and reach the app on a shared Docker network. Use the app's container port, not necessarily the port shown on Umbrel's dashboard.
1. Create and secure the tunnel
In Cloudflare Zero Trust:
- Create a tunnel.
- Install or configure the cloudflared connector on Umbrel with the tunnel token.
- Confirm the tunnel reports Healthy.
- Create a Cloudflare Access application for the hostname before publishing an administrative interface.
Treat the connector token as a secret. Anyone who obtains it may be able to run another connector for that tunnel.
2. Find the current container and network
Umbrel app internals can change after updates, so discover them instead of copying an old name:
sudo docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Ports}}'
Set the app container name for the rest of the checks:
APP_CONTAINER=searxng_web_1
sudo docker inspect "$APP_CONTAINER" \
--format '{{json .NetworkSettings.Networks}}'
Find the port on which the application listens inside its container:
sudo docker exec "$APP_CONTAINER" sh -lc \
'command -v ss >/dev/null && ss -ltnp || netstat -ltnp'
Do not assume that the Umbrel dashboard port is the internal port.
3. Prove connector-to-app reachability
Find the cloudflared container and its networks:
sudo docker ps --format '{{.Names}}' | grep -i cloudflared
sudo docker inspect CLOUDFLARED_CONTAINER \
--format '{{json .NetworkSettings.Networks}}'
If the containers do not share a network, connect cloudflared to the app's network. This Docker attachment may need to be repeated after an app is recreated, so document it and test after Umbrel upgrades.
Probe from the connector or from a temporary curl container on the same network:
sudo docker run --rm --network APP_NETWORK \
curlimages/curl:8.12.1 -I \
http://APP_CONTAINER:INTERNAL_PORT/
An HTTP 200 or expected redirect proves the internal path. A timeout or DNS error means Cloudflare configuration is not yet the problem.
4. Add the public hostname
In the tunnel's Published application routes or Public hostnames section, add:
- Hostname: app.example.com
- Service: http://APP_CONTAINER:INTERNAL_PORT
- HTTP Host header: only override this when the origin application requires a specific host
Cloudflare's current documentation uses local services such as http://localhost:8080 as the basic pattern. In a containerized Umbrel install, localhost refers to the connector container itself, so the shared-network container name is the useful equivalent.
Test from outside your home network:
curl -I https://app.example.com/
5. Make the app proxy-aware
Applications that create absolute links, OAuth callbacks, or webhooks may need their external URL configured. For n8n, for example, settings such as N8N_HOST, N8N_PROTOCOL, WEBHOOK_URL, and N8N_PROXY_HOPS may be required. Use the application's current documentation and restart it after changing environment variables.
Troubleshooting by error
Cloudflare 502
Cloudflare reached the connector, but cloudflared could not reach the origin. Recheck container name, internal port, scheme, Docker network, and whether the app listens on 0.0.0.0 rather than only 127.0.0.1.
Cloudflare 404
The hostname may not match a published route, or an earlier wildcard route may be taking precedence.
Redirect loop
The app and Cloudflare disagree about HTTP versus HTTPS. Configure the app's external URL and trusted proxy settings; do not blindly disable all TLS checks.
It works until Umbrel updates
The app container or network was recreated. Rediscover the live names and reattach the connector. Avoid building permanent automation around undocumented container names without a health check.
Security checklist
- Put Cloudflare Access in front of admin interfaces.
- Keep application authentication enabled too.
- Never publish services that expose private keys or wallet controls.
- Limit session duration and require phishing-resistant MFA where possible.
- Review Cloudflare and application access logs.
- Patch cloudflared, Umbrel, and the app.
- Maintain a separate recovery path that does not depend on the tunnel.
See the official Cloudflare Tunnel overview and routing documentation for current terminology and supported origin settings.