Skip to content

Zero Trust Tunnel

Publishes services through a Cloudflare Tunnel (cloudflared) without opening inbound ports.

Rune: zerotrust - Active when: install = true - Default: off

What it deploys

  • The pinned cloudflared binary, run as a dedicated cloudflare service user.
  • /etc/cloudflare/tunnel.yml (mode 0600) with the tunnel token, protocol, HA connection count, and post-quantum setting.
  • A cloudflare-tunnel systemd unit; with route_through_warp, a helper script routes tunnel traffic out through the WARP interface and the unit orders itself after the WARP service.

Create the tunnel and copy its token from the Cloudflare Zero Trust dashboard (or cloudflared tunnel create); NullForge runs the connector, it does not create tunnels.

Configuration (features.zerotrust)

Field Default Description
install false Deploy the tunnel connector
token None Tunnel token - required when installing; redacted in debug output
protocol "auto" auto, quic, or http2
post_quantum false Post-quantum key agreement (QUIC only)
ha_connections 2 High-availability connections (1-4)
route_through_warp false Egress the tunnel through the WARP interface

Validation rejects impossible combinations at plan time: installing without a token, post-quantum over HTTP/2, and post-quantum together with WARP routing.

route_through_warp assumes WARP is active on the same host - its interface and service names are read from features.warp.

Example

from nullforge.molds import ZeroTrustTunnelMold

zerotrust = ZeroTrustTunnelMold(
    install=True,
    token="eyJhIjo...",
    post_quantum=True,
)