cloudflared Systemd Service Pack

Stop hand-rolling cloudflared installs that drift and break on reboot.

This pack automates the entire lifecycle: distro detection, multi-arch support (amd64/arm64/armhf), official apt repository setup, hardened systemd units, and weekly automatic updates. For bare-metal, VPS, and Raspberry Pi users who want Cloudflare Tunnel running reliably without Docker.

What's Included

• install.sh — Detects Ubuntu/Debian/Raspberry Pi OS and CPU architecture; adds official Cloudflare apt repository; installs cloudflared. Idempotent (safe to re-run).
• setup-tunnel.sh — Guided setup: login via browser, create tunnel, generate config, enable service.
• cloudflared.service — Hardened systemd unit (NoNewPrivileges, ProtectSystem, MemoryDenyWriteExecute, RestrictAddressFamilies). Restarts on crash and reboot.
• cloudflared-update.service + timer — Automatic weekly updates (Sundays 02:00 UTC + random jitter). Installs package updates and restarts service.
• config.yml.example — Annotated config template with example ingress rules for HTTP/HTTPS/TCP routing.
• uninstall.sh — Cleanly removes package, config, and credentials with confirmation prompts.

How It Works

Run four commands: extract, install, setup, verify. The service runs as root in a hardened sandbox, reads your tunnel credentials and config file, proxies requests to local services, and auto-updates weekly. Credentials live in /root/.cloudflared/ (never committed); config in /etc/cloudflared/config.yml (can be versioned).

Requirements

• OS: Ubuntu 20.04+ / Debian 10+ / Raspberry Pi OS (32-bit or 64-bit)
• CPU: amd64, arm64, or armhf (Pi 3B+/4/Zero 2W supported)
• Root access (will prompt for sudo)
• Internet: For Cloudflare Tunnel login and package downloads
• Cloudflare account: Free or paid (Tunnel is free tier compatible)

No Docker required. Works on Pi Zero 2 W and up, VPS, and bare metal. Self-update via apt package manager (not cloudflared's built-in self-update, which is disabled when managed by apt).