Step 4 - Cloudflare Tunnels

Cloudflare Tunnel are an excellent way to expose your Spokes Web UI securely without opening inbound ports on your router for web traffic.

Proxying the Web UI

1. Create a tunnel in the Cloudflare Zero Trust dashboard.
2. Install the cloudflared connector on your Docker host.
3. In the Public Hostname configuration:
   • Subdomain: e.g., spokes
   • Domain: yourdomain.com
   • Service Type: HTTP (or HTTPS if your host proxy handles SSL locally)
   • URL: localhost:8080 (or the Web UI port you decided on in Step 1).

Crucial: LiveKit Voice & Video ports

Cloudflare Tunnels do not support UDP routing for free plans, and their TCP tunneling can introduce significant latency for real-time voice and video.

Therefore, you must still port forward the LiveKit voice ports directly on your hardware router in Step 5. The Web UI can go through Cloudflare, but the voice traffic must connect directly.