Tunnel & Networking

What Tunnel & Networking does

Open a server and select the Tunnel & Networking tab. A tunnel serves traffic through an outbound connection — no inbound ports opened and no firewall changes. It covers two jobs:

• Serve an app on your domain — point app.example.com at a container without publishing its port
• Let your apps reach each other — connect an app to a database by a stable private name, then close the public port

Private connections work without Cloudflare. Public hostnames need a Cloudflare account.

Install a tunnel and connect Cloudflare

A server with no tunnel shows No tunnel on this server yet ("A tunnel serves traffic through an outbound connection — no inbound ports opened and no firewall changes").

1. Click Install tunnel
2. Click Connect Cloudflare account (later Update Cloudflare account) to enable public hostnames
3. The Tunnel card then shows the Cloudflare account, Tunnel, and Connector, with badges such as Adopted, Observation only, or Update available

Tunnel actions include Re-check, Convert to managed, Update connector, and Repair.

Public hostnames

In the Public hostnames section, click Add hostname to map a hostname to an app. The table columns are Hostname, App, Private name, Server IP access, and Status. Set Server IP access to Closed (recommended) so the app stops answering on the raw server IP once the hostname is live. Routes report as Live, Removing…, Cleanup paused, or Setup paused.

Private connections between apps

In the Private connections section, click Connect apps to let one app reach another by a stable private name. The table shows From, Reaches, Address used, Public port, and Status (Connected / Failed). Because private connections work without Cloudflare, you can connect an app to its database privately and then close the database's public port.

Adopt a tunnel you already run

If a Cloudflare tunnel already serves this server, you do not have to rebuild it. Click Scan for existing tunnels to list the tunnels in your saved Cloudflare accounts, each with its hostnames and any connector found on this server. Click Adopt on one to open Adopt existing tunnel, then pick how Server Compass should take it over:

• Observe only — track the tunnel's health and hostnames without changing anything; the existing connector keeps running untouched
• Run a managed connector — install a Server Compass connector alongside the current one after verifying every existing hostname stays reachable, so you can add hostnames later
• Run on the entry-point VPS (k3s / localhost) — for tunnels whose services live on the VPS itself, on localhost ports or a Kubernetes (k3s) ingress. Server Compass uses the VPS's host network, checks every origin, then adds its connector to the same tunnel. Docker and Compose are required on the VPS
• Reconnect the Server Compass connector — reattach to a connector Server Compass installed earlier, without restarting it

Adoption records the tunnel's current configuration as the baseline instead of replacing it, and existing hostnames stay untouched. Every hostname is checked before a new connector starts; if any check fails, nothing changes on the server or in Cloudflare. After an entry-point adoption, keep managing those hostnames in Cloudflare — adding Docker service routes needs a standard connector. If you would rather start fresh, choose Create a new dedicated tunnel instead.