Cloudflare Tunnel and Zero Trust Config

Cloudflare Tunnel with Zero Trust Access via Terraform

Terraform configuration that provisions a Cloudflare Tunnel for your internal services, Zero Trust Access policies scoped per application, and identity provider integration — no inbound ports required on your origin servers.

What's Included

• Cloudflare Tunnel provisioned via Terraform with auto-generated credentials secret
• Per-application Access policies (email allowlist, GitHub org, or Google Workspace)
• Identity provider integration config for GitHub, Google, or Okta (choose one)
• Hostname routing rules mapping public subdomains to internal service addresses
• cloudflared Docker Compose service that reads the tunnel token from environment
• Terraform outputs for tunnel token and Access application URLs

What You Get

• main.tf — Cloudflare provider, tunnel, and Access application resources
• policies.tf — Access policy definitions per application
• variables.tf + terraform.tfvars.example — all configurable inputs
• docker-compose.yml — cloudflared container wired to read token from .env
• README.md — Cloudflare API token scopes, identity provider setup, adding new services

Requirements

• Cloudflare account (free plan works) with a zone managed in Cloudflare DNS
• Terraform 1.5+ and Cloudflare provider v5
• Docker on your origin host to run cloudflared