Skip to content
Budvo
Install

Remote access: Cloudflare Tunnel

A Cloudflare Tunnel gives your server a real HTTPS address, like https://money.example.com, without opening any port on your router. cloudflared runs next to Budvo and makes an outbound connection to Cloudflare; requests to your hostname come back through it.

You need a free Cloudflare account and a domain whose DNS is on Cloudflare.

1. Create the tunnel

  1. In the Cloudflare dashboard, open Zero Trust, then Networks, Tunnels, and create a tunnel of type Cloudflared.
  2. Name it (for example budvo) and copy the tunnel token from the install command it shows. You only need the long token, not the command.
  3. Under Public hostnames, add one: pick a subdomain such as money on your domain, set the service type to HTTP and the URL to budvo:8484.

2. Add cloudflared to your compose file

Put the token in a .env file next to docker-compose.yml:

.env
CLOUDFLARE_TUNNEL_TOKEN=paste-the-token-here

Then add the cloudflared service, and set BUDVO_TRUST_PROXY to true so Budvo reads the real client address and knows the request came in over HTTPS:

docker-compose.yml
services:  budvo:    image: git.ronniie.com/nulldaily/budvo:latest    container_name: budvo    restart: unless-stopped    ports:      - "8484:8484"    volumes:      - ./data:/data    environment:      TZ: America/New_York      BUDVO_TRUST_PROXY: "true"     # requests arrive through the tunnel  cloudflared:    image: cloudflare/cloudflared:latest    restart: unless-stopped    command: tunnel --no-autoupdate run    environment:      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}    depends_on: [budvo]
terminal
docker compose up -d

Open https://money.example.com. You should see the dashboard's sign-in or unlock screen.

Good to know

  • Trust the proxy only behind a proxy. With BUDVO_TRUST_PROXY=true, Budvo believes the X-Forwarded-* headers. That's right when every request arrives through the tunnel. If you also use the local port, it still works, but don't expose that port to the internet.
  • Keep local access local. You can bind the local port to one machine with "127.0.0.1:8484:8484", or remove the ports section entirely and use only the tunnel.
  • An extra lock on the door. Cloudflare Access can put its own sign-in in front of your hostname. It works well for the dashboard in a browser, but the iOS app talks to the server directly, so skip Access (or bypass it for /api) if you plan to use the app.
  • Two-factor matters more now. Your sign-in page is on the internet. Turn on two-factor for everyone on the server.
PreviousFirst setupNext Tailscale