---
name: "cloudflare-zero-trust-tunnels"
description: "Expose internal servers and databases to the internet securely without opening public firewall ports."
metadata:
  author: "Cloudflare"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "setup cloudflared tunnel"
  - "expose internal service cloudflare tunnel"
  - "zero trust access cloudflare"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Cloudflare Zero Trust Tunnels (cloudflared)

Deploys Cloudflare Tunnels (cloudflared): running connector daemons in Docker/systemd, routing private host traffic to Cloudflare edge, authenticating access via Zero Trust Access (Okta, Google, email OTP).

## When to Invoke
Invoke this skill whenever you need to:
- setup cloudflared tunnel
- expose internal service cloudflare tunnel
- zero trust access cloudflare

## Execution SOP & Rules
1. Create tunnel via dashboard or CLI: cloudflared tunnel create <tunnel-name>.
2. Write config.yml specifying ingress rules: - hostname: app.example.com, service: http://localhost:3000.
3. Route DNS: cloudflared tunnel route dns <tunnel-name> app.example.com.
4. Run daemon: cloudflared tunnel run <tunnel-name> or deploy official cloudflare/cloudflared container.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.