cloudflared & wrangler (Cloudflare tunnel + Workers CLIs)

What it is

Two Cloudflare CLIs: cloudflared runs/manages tunnels (our pf-tunnel-v2 exposes the *.portugalfuturista.org services), and wrangler builds and deploys Cloudflare Workers/Pages.

Install

cloudflared (official apt repo):

curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg \
  | sudo tee /usr/share/keyrings/cloudflare-main.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] \
  https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" \
  | sudo tee /etc/apt/sources.list.d/cloudflared.list
sudo apt update && sudo apt install cloudflared

wrangler (via npm, current stable):

npm install -g wrangler

Authenticate

cloudflared tunnel login        # browser → authorizes the zone, writes ~/.cloudflared/cert.pem
wrangler login                  # browser OAuth for your Cloudflare account

API tokens (for CI) go in Vaultwarden (https://vault.portugalfuturista.org) and are exported as CLOUDFLARE_API_TOKEN.

Configure for this environment

pf-tunnel-v2 runs on asus (192.168.0.38), config at /etc/cloudflared/config-v2.yml — tunnel administration happens there, not on the laptop. From the laptop you typically only:

cloudflared tunnel list                 # see pf-tunnel-v2 and its connectors
cloudflared tunnel info pf-tunnel-v2
cloudflared tunnel route dns pf-tunnel-v2 new-service.portugalfuturista.org

Adding a service = edit config-v2.yml on asus (ingress rule) + DNS route, then restart the cloudflared service on asus.

wrangler for Workers:

wrangler init my-worker
cd my-worker && wrangler dev            # local dev server
wrangler deploy

Self-hosted equivalent

The tunnel is our self-hosted edge: pf-tunnel-v2 on asus fronts all *.portugalfuturista.org services — no third-party ingress needed. Workers have no self-hosted runtime in production; for local dev wrangler dev (and Miniflare under the hood) emulates the Workers runtime on the laptop.

Aurélio integration

The cli-edge skill uses cloudflared for tunnel/DNS routes and wrangler for Workers deploys. Connector registry id: cloudflare.

Verify

cloudflared --version
# cloudflared version 20xx.y.z ...
wrangler --version
#  ⛅️ wrangler x.y.z
cloudflared tunnel list
# ID  NAME          CREATED  CONNECTIONS
# ... pf-tunnel-v2  ...      2xLISB

Troubleshooting

tunnel login cert lands on the wrong machine — the cert is per-user, per-machine; run cloudflared tunnel login on asus if you're managing the tunnel there, then copy ~/.cloudflared/<uuid>.json credentials carefully.
DNS route already exists — cloudflared tunnel route dns refuses to overwrite; delete the CNAME in the dashboard or with cloudflared tunnel route dns --overwrite-dns.
wrangler Unauthorized — token scope too narrow; create a token with "Workers Scripts:Edit" and re-export CLOUDFLARE_API_TOKEN.
Service 502 behind the tunnel — check the ingress rule in config-v2.yml on asus points at a reachable LAN address, then journalctl -u cloudflared on asus.

3.2 KiB Raw Blame History