Cloudflare Tunnel

# Login ด้วย Browser
cloudflared tunnel login

# หรือ Login ด้วย API Token
cloudflared tunnel login --token YOUR_API_TOKEN

# สร้าง tunnel ใหม่
cloudflared tunnel create my-tunnel

# ผลลัพธ์จะแสดง Tunnel ID
# Tunnel credentials written to ~/.cloudflared/.json

# สร้าง CNAME record ชี้ไป tunnel
cloudflared tunnel route dns my-tunnel app.example.com

# หรือใช้ Tunnel ID
cloudflared tunnel route dns  app.example.com

tunnel: 
credentials-file: /root/.cloudflared/.json

ingress:
  # กฎที่ 1: app.example.com ไปที่ localhost:3000
  - hostname: app.example.com
    service: http://localhost:3000
  
  # กฎที่ 2: api.example.com ไปที่ localhost:8080
  - hostname: api.example.com
    service: http://localhost:8080
  
  # กฎเริ่มต้น: ส่งคืน 404 สำหรับ path อื่นๆ
  - service: http_status:404

# รัน tunnel
cloudflared tunnel run my-tunnel

# หรือระบุ config file
cloudflared tunnel --config ~/.cloudflared/config.yml run

# ติดตั้งเป็น service
sudo cloudflared service install

# เริ่ม service
sudo systemctl start cloudflared

# เปิดใช้งานตอน boot
sudo systemctl enable cloudflared

# ตรวจสอบสถานะ
sudo systemctl status cloudflared

tunnel: 6ff42ae2-765d-4e26-b1f2-cbb23d9ba589
credentials-file: /home/user/.cloudflared/6ff42ae2-765d-4e26-b1f2-cbb23d9ba589.json

ingress:
  - hostname: dev.example.com
    service: http://localhost:3000
  - service: http_status:404

tunnel: 6ff42ae2-765d-4e26-b1f2-cbb23d9ba589
credentials-file: /home/user/.cloudflared/6ff42ae2-765d-4e26-b1f2-cbb23d9ba589.json

ingress:
  # Frontend
  - hostname: app.example.com
    service: http://localhost:3000
  
  # Backend API
  - hostname: api.example.com
    service: http://localhost:8080
  
  # Admin Dashboard
  - hostname: admin.example.com
    service: http://localhost:9000
  
  # Database Admin (เช่น Adminer)
  - hostname: db.example.com
    service: http://localhost:8081
  
  # Path-based routing
  - hostname: example.com
    path: /api/*
    service: http://localhost:8080
  
  - hostname: example.com
    path: /admin/*
    service: http://localhost:9000
  
  # Default
  - service: http_status:404

tunnel: 6ff42ae2-765d-4e26-b1f2-cbb23d9ba589
credentials-file: /home/user/.cloudflared/6ff42ae2-765d-4e26-b1f2-cbb23d9ba589.json

ingress:
  - hostname: ssh.example.com
    service: ssh://localhost:22
  - service: http_status:404

# ติดตั้ง cloudflared บนเครื่อง Client
# แล้วเพิ่ม config ใน ~/.ssh/config

Host ssh.example.com
    ProxyCommand cloudflared access ssh --hostname %h

version: '3.8'

services:
  # เว็บแอพ
  webapp:
    image: node:18-alpine
    working_dir: /app
    volumes:
      - ./app:/app
    command: npm start
    ports:
      - "3000:3000"
  
  # API Server
  api:
    image: node:18-alpine
    working_dir: /api
    volumes:
      - ./api:/api
    command: npm start
    ports:
      - "8080:8080"
  
  # Cloudflare Tunnel
  cloudflared:
    image: cloudflare/cloudflared:latest
    command: tunnel --config /etc/cloudflared/config.yml run
    volumes:
      - ./cloudflared/config.yml:/etc/cloudflared/config.yml:ro
      - ./cloudflared/credentials.json:/etc/cloudflared/credentials.json:ro
    depends_on:
      - webapp
      - api
    restart: always

# ตัวอย่างการตั้งค่า Load Balancing
# รัน multiple cloudflared instances บน port ต่างกัน

# Instance 1 (primary)
cloudflared tunnel --config ~/.cloudflared/config-primary.yml run

# Instance 2 (secondary)
cloudflared tunnel --config ~/.cloudflared/config-secondary.yml run

# ใช้ Load Balancer (เช่น Nginx) หน้า cloudflared

tunnel: 6ff42ae2-765d-4e26-b1f2-cbb23d9ba589
credentials-file: /home/user/.cloudflared/6ff42ae2-765d-4e26-b1f2-cbb23d9ba589-primary.json

ingress:
  # Primary services (port 3000)
  - hostname: app.example.com
    service: http://localhost:3000
  - service: http_status:404

tunnel: 6ff42ae2-765d-4e26-b1f2-cbb23d9ba589
credentials-file: /home/user/.cloudflared/6ff42ae2-765d-4e26-b1f2-cbb23d9ba589-secondary.json

ingress:
  # Secondary services (port 3001)
  - hostname: app.example.com
    service: http://localhost:3001
  - service: http_status:404

# /etc/systemd/system/cloudflared-ha@.service
[Unit]
Description=Cloudflare Tunnel %I (HA mode)
After=network.target

[Service]
Type=simple
User=cloudflared
Group=cloudflared
ExecStart=/usr/local/bin/cloudflared tunnel --config /etc/cloudflared/config-%i.yml run
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

# Re Load systemd daemon
sudo systemctl daemon-reload

# Start HA services
sudo systemctl start cloudflared-ha@primary
sudo systemctl start cloudflared-ha@secondary

# Enable auto-start
sudo systemctl enable cloudflared-ha@primary
sudo systemctl enable cloudflared-ha@secondary

# Check status
sudo systemctl status cloudflared-ha@primary
sudo systemctl status cloudflared-ha@secondary

tunnel: 6ff42ae2-765d-4e26-b1f2-cbb23d9ba589
credentials-file: /home/user/.cloudflared/6ff42ae2-765d-4e26-b1f2-cbb23d9ba589.json

# Zero Trust Access settings
warp-routing:
  enabled: true

ingress:
  # Private network service
  - hostname: internal.example.com
    service: http://192.168.1.100:8080
    path: /api/*
    
  # Admin panel with authentication
  - hostname: admin.example.com
    service: http://localhost:9000
    path: /admin/*
    
  # Database access
  - hostname: db.example.com
    service: tcp://localhost:5432
    
  # Default - allow only from specific IP ranges
  - path: /*
    auth:
      oauth:
        provider: google
        options:
          allowed_domains: your-company.com
          allowed_emails:
            - user1@your-company.com
            - user2@your-company.com
          allowed_groups:
            - admins
    service: http_status:401