selfhost.directory

The index of self-hostable projects — ranked, categorized and served with live updates.
Own your data and stop giving it to big tech.

GitHub
Cloudflared-web logo

Self-host Cloudflared-web

2026.10.3

Cloudflare tunnel on/off switch with a web UI

ReleaseOpen SourceGPL-2.0
GitHub
Install
Updated4 months ago
LanguageVue
Setup difficultyEasy
Stars
474
Ports
14333 (Web UI for setting the token and starting/stopping the tunnel), 60123 (Tunnel metrics server, only when METRICS_ENABLE is true)
Docker
wisdomsky/cloudflared-web
Install with Docker
Cloudflared-web Web UI screen for managing the tunnelSecond view of the Cloudflared-web Web UI

What is Cloudflared-web?

Cloudflared-web is a single Docker image that ships the cloudflared command-line client together with a small web interface, so you can control a remotely-managed Cloudflare tunnel without editing config files by hand. You paste your tunnel token into the Web UI, then start or stop the tunnel with a single click, and the image keeps running unattended. The UI listens on port 14333 by default and can be protected with an optional password via basic auth, while tunnel behaviour such as protocol, region, edge IP version, retries and a metrics server is tuned with environment variables modelled on Cloudflare's tunnel-run parameters. A /config volume persists the token and start status across image updates, and the image is published on Docker Hub with a ghcr.io mirror for amd64, arm64 and arm v7. For networking to work, the docs stress running the container in host network mode (or with explicit Docker networks), which makes it a natural fit for home-server setups.

Should you self-host Cloudflared-web?

Cloudflared-web scores 47/100 on selfhost.directory (how scoring works) and ranks #20 of 31 in Networking. It has 474 GitHub stars.

There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.

Setup is easy: most people get it running in one sitting. An official Docker image is available. It is GPL-2.0-licensed and written mostly in Vue.

Its closest alternative on selfhost.directory is headscale (82/100, 45 140 stars). It scores higher overall, so compare the two before you pick. See Cloudflared-web vs headscale side by side.

Features

  • Configurable connection retries
  • Configurable UI host and port
  • Docker networks support
  • Graceful shutdown with grace period
  • Language translations
  • One-click tunnel start/stop
  • Optional basic auth for the UI
  • Persistent /config volume
  • Run-and-forget operation
  • Tunnel metrics endpointDisabled by default (METRICS_ENABLE false).
  • Tunnel run parameter tuning
  • Web UI tunnel management

Cloudflared-web README

How to install Cloudflared-web

Install Cloudflared-web with Docker

Environment variables
WEBUI_HOST, WEBUI_PORT, BASIC_AUTH_USER, BASIC_AUTH_PASS, EDGE_BIND_ADDRESS, EDGE_IP_VERSION, PROTOCOL, GRACE_PERIOD, REGION, RETRIES, METRICS_ENABLE, METRICS_PORT

docker run --network host wisdomsky/cloudflared-web:latest

Host networking mode is required so cloudflared can reach services on the host; the UI is then at http://localhost:14333.

How to configure Cloudflared-web

  • BASIC_AUTH_PASSEnable Basic Auth by specifying a password. If `BASIC_AUTH_USER` is not specified, the default value for username `admin` will be used.

    Enable Basic Auth by specifying a password. If `BASIC_AUTH_USER` is not specified, the default value for username `admin` will be used.

  • BASIC_AUTH_USERadminSpecify the username for the Basic Auth.

    Specify the username for the Basic Auth.

  • EDGE_BIND_ADDRESSSpecifies the outgoing IP address used to establish a connection between `cloudflared` and the Cloudflare global network. The IP version of `EDGE_BIND_ADDRESS` will override `EDGE_IP_VERSION` (if provided). For example, if you enter an IPv6 source address, `cloudflared` will always connect to an IPv6 destination.

    Specifies the outgoing IP address used to establish a connection between `cloudflared` and the Cloudflare global network. The IP version of `EDGE_BIND_ADDRESS` will override `EDGE_IP_VERSION` (if provided). For example, if you enter an IPv6 source address, `cloudflared` will always connect to an IPv6 destination.

  • EDGE_IP_VERSIONautoSpecifies the IP address version (IPv4 or IPv6) used to establish a connection between `cloudflared` and the Cloudflare global network. Available values are `auto`, `4`, and `6`.

    Specifies the IP address version (IPv4 or IPv6) used to establish a connection between `cloudflared` and the Cloudflare global network. Available values are `auto`, `4`, and `6`.

  • GRACE_PERIOD30sWhen `cloudflared` receives SIGINT/SIGTERM it will stop accepting new requests, wait for in-progress requests to terminate, then shut down. Waiting for in-progress requests will timeout after this grace period, or when a second SIGTERM/SIGINT is received.

    When `cloudflared` receives SIGINT/SIGTERM it will stop accepting new requests, wait for in-progress requests to terminate, then shut down. Waiting for in-progress requests will timeout after this grace period, or when a second SIGTERM/SIGINT is received.

  • METRICS_ENABLEfalseEnable tunnel metrics server.

    Enable tunnel metrics server.

  • METRICS_PORT60123Specify port to run tunnel metrics on. `METRICS_ENABLE` must be set to `true`.

    Specify port to run tunnel metrics on. `METRICS_ENABLE` must be set to `true`.

  • PROTOCOLautoSpecifies the protocol used to establish a connection between `cloudflared` and the Cloudflare global network. Available values are `auto`, `http2`, and `quic`.

    Specifies the protocol used to establish a connection between `cloudflared` and the Cloudflare global network. Available values are `auto`, `http2`, and `quic`.

  • REGIONAllows you to choose the regions to which connections are established. Currently the only available value is `us`, which routes all connections through data centers in the United States. Omit or leave empty to connect to the global region.

    Allows you to choose the regions to which connections are established. Currently the only available value is `us`, which routes all connections through data centers in the United States. Omit or leave empty to connect to the global region.

  • RETRIES5Specifies the maximum number of retries for connection/protocol errors. Retries use exponential backoff (retrying at `1`, `2`, `4`, `8`, `16` seconds by default), so it is NOT RECOMMENDED that you increase this value significantly.

    Specifies the maximum number of retries for connection/protocol errors. Retries use exponential backoff (retrying at `1`, `2`, `4`, `8`, `16` seconds by default), so it is NOT RECOMMENDED that you increase this value significantly.

  • WEBUI_HOST0.0.0.0This will work if you want the WebUI to listen on a different host address

    This will work if you want the WebUI to listen on a different host address

  • WEBUI_PORT14333The port on the host where the WebUI will be running. Useful when an existing process is running on port `14333` and want to assign cloudflared-web into a different available port.

    The port on the host where the WebUI will be running. Useful when an existing process is running on port `14333` and want to assign cloudflared-web into a different available port.

More in Reverse Proxy

Rate this project

Click to rate — no account needed.

0 comments

Posting as guest
Loading comments…