Cloudflare Tunnel + Traefik Stack

No More Firewall Rules. Route by Docker Labels.

Every new service used to mean editing your tunnel ingress rules or clicking through the Cloudflare dashboard. This stack wires Cloudflare Tunnel and Traefik v3 to make the common case instant: add a container to the compose file, drop two labels on it, and traffic flows. DNS routes through the single tunnel. Traefik matches by Host() labels. Real client IP comes through. TLS is handled at Cloudflare's edge.

What Is Included

• docker-compose.yml — traefik:v3.7.13, cloudflared (latest, no auto-update), whoami example service with full label setup
• traefik/traefik.yml — static config with docker provider (exposedByDefault: false), entrypoint :80, trusted headers from Cloudflare edge
• traefik/dynamic.yml — security headers middleware, gzip compression, CF header pass-through
• config/cloudflared-config.yml — credentials-file mode, single catch-all ingress to traefik:80, 404 fallback
• .env.example — DOMAIN and TUNNEL_NAME variables
• .gitignore — excludes credentials.json
• README.md — 5-min quickstart, add-a-service recipe, real IP flow, TLS story, DNS routing options, troubleshooting

How It Works

Cloudflare edge terminates TLS. cloudflared maintains an encrypted outbound tunnel and forwards all requests to Traefik's internal :80. Traefik inspects the Host header and routes by Docker labels — traefik.enable=true and traefik.http.routers.service.rule=Host(...). Services sit on the isolated tunnel-network. No ports exposed. Real client IP (CF-Connecting-IP) flows through trusted headers.

What You Get Immediately

• One tunnel ingress rule handles all hostnames (wildcard + apex)
• Services route by Docker labels, not manual config edits
• Cloudflare DDoS protection and TLS for free
• whoami.example.com works on first docker compose up -d (after DNS route)
• JSON logging (structured, easy to parse)

Requirements

• Cloudflare account with domain registered on Cloudflare nameservers
• Docker and Docker Compose
• A tunnel created via cloudflared tunnel create <name> (free tier)
• Credentials file copied to config/credentials.json