Nomploy Nomad Packs

← All packs

cloudflared v0.1.0

Networking

cloudflared — run a Cloudflare Tunnel to expose your Nomad services to the internet over an outbound-only connection, no open inbound ports or public IP required. Deployed as a stateless host-networked Nomad service driven by a tunnel token.

nomad-pack run cloudflared --registry nomploy

Source ↗ Project ↗ ★ 15.9k

1 task image cloudflare/cloudflared:latest
Variables 8
values.hcl

Save as values.hcl, edit, then run:

nomad-pack run cloudflared -f values.hcl --registry nomploy
# The name of the Nomad job.
job_name = "cloudflared"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The cloudflared container image. Pin a tag in production.
image = "cloudflare/cloudflared:latest"

# REQUIRED. The tunnel token from the Cloudflare Zero Trust dashboard (Networks → Tunnels → your tunnel → install token). Treat it as a secret. Configure which hostname maps to which local service (e.g. http://127.0.0.1:8080) in the dashboard.
tunnel_token = ""

# Number of connector replicas (Cloudflare load-balances across them; 2+ gives HA).
count = 1

# Placement constraints. Host networking lets the connector reach services on 127.0.0.1. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# The task resources.
resources = {
    cpu    = 200
    memory = 128
  }
NameTypeDefaultDescription
job_name string 
"cloudflared"
 The name of the Nomad job.
namespace string 
"default"
 The Nomad namespace to deploy into.
datacenters list 
["*"]
 The datacenters to deploy to.
image string 
"cloudflare/cloudflared:latest"
 The cloudflared container image. Pin a tag in production.
tunnel_token key string 
""
 REQUIRED. The tunnel token from the Cloudflare Zero Trust dashboard (Networks → Tunnels → your tunnel → install token). Treat it as a secret. Configure which hostname maps to which local service (e.g. http://127.0.0.1:8080) in the dashboard.
count number 
1
 Number of connector replicas (Cloudflare load-balances across them; 2+ gives HA).
constraints list 
[]
 Placement constraints. Host networking lets the connector reach services on 127.0.0.1. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources object 
{
    cpu    = 200
    memory = 128
  }
 The task resources.
Readme

cloudflared

Cloudflare Tunnel via cloudflared — expose your Nomad services to the internet over an outbound-only connection: no open inbound ports, no public IP, no port-forwarding. Cloudflare terminates TLS and routes your chosen hostnames to local services. Stateless host-networked Nomad service.

Usage

  1. In the Cloudflare Zero Trust dashboard: Networks → Tunnels → create a tunnel, copy its token, and add public hostname → service routes (e.g. app.example.com → http://127.0.0.1:8080).
  2. Deploy the connector with that token:
nomad-pack registry add nomploy github.com/Nomploy/nomad-packs
nomad-pack run cloudflared --registry nomploy --var tunnel_token=<your-token>

In nomploy: create a Compose service, type Nomad Pack, pack cloudflared, set tunnel_token, then Deploy. The tunnel should show HEALTHY in the dashboard.

Key variables

Variable Default Notes
image cloudflare/cloudflared:latest Pin a tag in production.
tunnel_token "" Required — the tunnel's token (a secret).
count 1 Replicas; 2+ gives HA (Cloudflare load-balances connectors).
constraints [] Placement.
resources cpu 200 / mem 128 Lightweight.

Notes