otty / apps

All apps/cloudflared

cloudflared

Cloudflare Tunnel client: connects a service to Cloudflare's network without opening an inbound port.

Runs as cloudflared|macOS, Linux, Windows|developers.cloudflare.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

cloudflared in your home directory Every rule on this page, by file

tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef

credentials-file: /Users/octocat/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.jsonmachine-local

loglevel: info

ingress:

…

Each machine keeps its own copy of these.

· cert.pem Never synced

· *.json Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/cloudflared/otty.tomlThe file this page is generated from

id = "cloudflared"

name = "cloudflared"

homepage = "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/"

description = "Cloudflare Tunnel client: connects a service to Cloudflare's network without opening an inbound port."

icon = "theSVG:cloudflare"

executables = ["cloudflared"]

[dotfiles]

# https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/

# — "The default configuration path used by cloudflared is ~/.cloudflared/

# config.yml"; on Windows the same page spells it

# %USERPROFILE%\.cloudflared\config.yml, which is the same path here.

paths = ["~/.cloudflared/config.yml"]

exclude = []

# Same section: "An account certificate (cert.pem) is issued for a Cloudflare

# account when you login to cloudflared. The cert.pem gives cloudflared the

# capabilities to create tunnels and modify DNS records in the account", and

# "The tunnel credentials JSON file is stored at ~/.cloudflared/<UUID>.json".

# Both are bearer credentials for the account.

secret = ["~/.cloudflared/cert.pem", "~/.cloudflared/*.json"]

# `credentials-file` is an absolute path into this machine's ~/.cloudflared,

# naming the key file this connector runs on, so it is kept for a rebuild of

# this machine rather than discarded: backup —

# the example config on the page above reads

# `credentials-file: /root/.cloudflared/6ff42ae2-….json`. The tunnel UUID and

# the ingress rules identify the tunnel itself and travel with it.

[[dotfiles.machine_lines]]

file = "~/.cloudflared/config.yml"

match = { key_path = ["credentials-file"] }

scope = "backup"

[commands]

format = 1

label = "cloudflared"

description = "Run, create and list Cloudflare Tunnels."

quality = "ai-draft"

base = "fig:cloudflared"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/cloudflared.ts"

license = "MIT"

[[commands.subcommand]]

path = ["tunnel"]

label = "Quick tunnel"

description = "Expose a local URL through a Cloudflare Tunnel, or run a named tunnel. Ingress rules and proxy tuning are left out."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/cloudflared.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "url"

label = "Local URL"

type = "url"

option = ["--url"]

suggestions = [{ value = "http://localhost:8080", label = "http://localhost:8080" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "hello_world"

label = "Hello World server"

type = "boolean"

option = ["--hello-world"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "name"

label = "Tunnel name"

description = "Creates, routes and runs a tunnel with this stable name."

type = "string"

option = ["--name", "-n"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "hostname"

label = "Hostname"

type = "string"

option = ["--hostname"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "config"

label = "Config file"

type = "path"

option = ["--config"]

path = { kind = "file", role = "input", must_exist = true }

sources = ["fig"]

[[commands.subcommand.field]]

id = "loglevel"

label = "Log level"

type = "enum"

option = ["--loglevel"]

choices = [{ value = "debug", label = "debug" }, { value = "info", label = "info" }, { value = "warn", label = "warn" }, { value = "error", label = "error" }, { value = "fatal", label = "fatal" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "no_tls_verify"

label = "Skip origin TLS verification"

type = "boolean"

option = ["--no-tls-verify"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "quick"

label = "Expose a local URL"

fields = ["url", "loglevel", "no_tls_verify"]

required = ["url"]

[[commands.subcommand.task]]

id = "hello"

label = "Try Hello World"

set = { hello_world = [true] }

fields = ["hello_world"]

required = []

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["url", "hello_world", "name", "hostname"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["config", "loglevel", "no_tls_verify"]

[[commands.subcommand]]

path = ["tunnel", "run"]

label = "Run a tunnel"

description = "Run an existing tunnel by name or UUID."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/cloudflared.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "tunnel"

label = "Tunnel name or UUID"

type = "string"

position = 0

sources = ["fig"]

[[commands.subcommand.field]]

id = "url"

label = "Local URL"

type = "url"

option = ["--url"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "config"

label = "Config file"

type = "path"

option = ["--config"]

path = { kind = "file", role = "input", must_exist = true }

sources = ["fig"]

[[commands.subcommand.field]]

id = "credentials_file"

label = "Credentials file"

type = "path"

option = ["--credentials-file", "--cred-file"]

path = { kind = "file", role = "input", must_exist = true }

sources = ["fig"]

[[commands.subcommand.field]]

id = "loglevel"

label = "Log level"

type = "enum"

option = ["--loglevel"]

choices = [{ value = "debug", label = "debug" }, { value = "info", label = "info" }, { value = "warn", label = "warn" }, { value = "error", label = "error" }, { value = "fatal", label = "fatal" }]

sources = ["fig"]

[[commands.subcommand.task]]

id = "run"

label = "Run a tunnel"

fields = ["tunnel", "url", "config", "loglevel"]

required = ["tunnel"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["tunnel", "url", "config"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["credentials_file", "loglevel"]

[[commands.subcommand]]

path = ["tunnel", "create"]

label = "Create a tunnel"

description = "Create a tunnel and its credentials file."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/cloudflared.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "name"

label = "Tunnel name"

type = "string"

position = 0

sources = ["fig"]

[[commands.subcommand.field]]

id = "credentials_file"

label = "Credentials file"

type = "path"

option = ["--credentials-file", "--cred-file"]

path = { kind = "file", role = "output", must_exist = false }

effect = "overwrite"

sources = ["fig"]

[[commands.subcommand.field]]

id = "output"

label = "Output format"

type = "enum"

option = ["--output", "-o"]

choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }]

sources = ["fig"]

[[commands.subcommand.task]]

id = "create"

label = "Create a tunnel"

fields = ["name", "credentials_file", "output"]

required = ["name"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["name", "credentials_file", "output"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/cloudflared. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps all credential files out. None of them splits credentials-file for you — that part is Otty’s own sync, or a template you write by hand.