Docs / Platform Ops

Cloudflare tunnel setup

Configure Cloudflare Zero Trust tunnel ingress so customer service URLs resolve with free Universal SSL.

SSL/TLS mode

Zone isoward.com → SSL/TLS → Overview → Full (not Full Strict).

Traffic path: browser → Cloudflare is HTTPS; Cloudflare → cloudflared is encrypted by the tunnel; cloudflared → http://isoward-gateway:9876 on the private Docker network is HTTP by design. Do not flip to Full Strict or chase an Origin CA certificate for this setup—Strict expects a trusted TLS cert on the origin, which the tunnel + HTTP gateway model does not use. Do not expose host ports 80 or 443.

Wildcard public hostname

Isoward uses a dedicated tunnel connector (isoward-tunnel) with config in deploy/cloudflared/config.yml. Add near the bottom of that ingress:

Subdomain*
Domainisoward.com
Service URLhttp://isoward-gateway:9876 (alias isoward-gateway)

Ingress is top-to-bottom, first match wins. BreachFix hostnames use a separate tunnel.

DNS wildcard

CNAME * → {tunnel-id}.cfargotunnel.com, proxied (orange cloud). Cloudflare may not auto-create this when adding the wildcard hostname: add manually if missing.

Cutover checklist

  1. docker compose --profile tunnel up -d --build in isoward (joins isoward-net)
  2. Set ISOWARD_PUBLIC_URL and related env vars in .env
  3. Confirm ingress in deploy/cloudflared/config.yml: apex and *; cloud redirects via Cloudflare
  4. DNS wildcard CNAME → Isoward tunnel ID
  5. docker restart isoward-tunnel
  6. ./scripts/verify-public-routing.sh --brand isoward

Control plane is the apex isoward.com. Service URLs use one label under that zone so free Universal SSL covers *.isoward.com (nested names like *.cloud.isoward.com need paid ACM).

Automated DNS: run ./scripts/setup-isoward-cloudflare.sh. See Hostnames & routing.