Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click Coolify, NVMe storage and a 14-day free trial.
You can publish a Coolify application through Cloudflare without opening inbound ports on your router or revealing the server’s public IP. The reliable pattern is to run cloudflared on the Coolify host (or as a Coolify resource), create a Cloudflare Tunnel, and point a published hostname route at the host-mapped port that reaches Coolify’s proxy or your application. Cloudflare handles the public HTTPS connection; the tunnel carries the request to your server over an outbound connection.
For several applications, route the tunnel to Coolify’s proxy and let Coolify select the application by hostname. For one application, route directly to that application’s mapped host port. The most common failures—404, 502, connection refused, and certificate errors—come from an incorrect hostname rule, using a container-only port, or assuming edge HTTPS automatically enables HTTPS at the origin.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What this setup does
A Cloudflare Tunnel creates an outbound connection from your Coolify server to Cloudflare. Visitors connect to a hostname at Cloudflare, and Cloudflare forwards matching requests through that connector to a local service. Because the connection is initiated from inside your network, you do not need router port forwarding or an inbound firewall rule for the application.
Coolify documents tunnels as a way to expose local servers and applications, including installations on Raspberry Pi hardware, without opening router ports. The connector still needs ordinary internet access. A Cloudflare account, a domain managed in Cloudflare, and a server or virtual machine where cloudflared can run are required.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
This guide covers HTTP and HTTPS web applications. SSH and other TCP-based services use a different client-assisted flow, described later.
Choose the tunnel scope before changing Coolify
Decide whether one tunnel will serve every Coolify application or only one resource. This choice determines where the Cloudflare service URL points and which domains you leave configured in Coolify.
| Pattern | Best for | Coolify configuration | Cloudflare service URL | Main trade-off |
|---|---|---|---|---|
| All resources through the proxy | A beginner or a server hosting several applications | Deploy cloudflared in Coolify and send tunnel traffic to Coolify’s proxy. Keep each application’s hostname routing in Coolify. |
The local address and port where the tunnel can reach the Coolify proxy; use the port exposed by your installation. | One connector and one tunnel can cover many apps, but a proxy or hostname mistake can affect all of them. |
| Single resource | One application that needs isolated exposure | Remove the application’s existing public domains, set its exposed and mapped ports, and deploy it. | The local host address plus that resource’s mapped host port. Coolify’s example uses http://localhost:4477; replace 4477 with your actual mapping. |
Isolation is clearer, but every additional application needs its own route and port planning. |
The all-resources pattern is generally simpler when you are learning Coolify because Coolify remains the hostname-aware reverse proxy. The single-resource pattern is useful when you deliberately want a tunnel route to bypass that shared proxy and reach one mapped service.
Prerequisites and decisions
Cloudflare account and DNS zone
Your domain must be active in Cloudflare DNS. The hostname you publish—such as app.example.com—must belong to that zone. Cloudflare creates a tunnel endpoint under cfargotunnel.com; the public hostname record in your zone points to that tunnel endpoint and remains proxied.
A running Coolify deployment
Coolify must be installed and reachable from the machine where the connector runs. Deploy the target application before testing a route. If the resource is stopped, still building, or listening only on an internal container port, the tunnel can be healthy while the application remains unreachable.
A connector host with outbound internet access
You can run cloudflared as a resource managed by Coolify or install it directly on the server. A restrictive egress firewall may need outbound TCP or UDP access to Cloudflare on port 7844. This is an outbound requirement; it is not a router port-forwarding rule.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Choose the origin protocol
The basic Coolify arrangement is HTTPS from the visitor to Cloudflare, then HTTP from the tunnel to the local Coolify proxy or application. That is often the least complicated option when the local service is intentionally plain HTTP. If the application requires encrypted traffic at the origin—for example, because of a cookie, login, or protocol policy—configure full origin TLS instead of merely changing the zone’s SSL mode.
Prepare the application in Coolify
All-resources preparation
- Confirm the Coolify server and the target applications are deployed.
- Identify the local address and port on which Coolify’s proxy accepts traffic from the connector. Use the port exposed by your specific Coolify installation rather than assuming a default.
- Keep each application’s intended public domain in its Coolify configuration. The proxy uses the incoming
Hostheader to select the correct application.
When the tunnel sends a request for app.example.com to the proxy, Coolify’s routing layer must have a matching domain. A tunnel route alone does not create an application route inside Coolify.
Single-resource preparation
- Open the application or service in Coolify and remove its existing public domains for this test. This avoids competing ingress paths while you establish the direct route.
- Check the container’s exposed port and the server’s mapped host port. They are not necessarily the same number.
- Deploy or redeploy the resource so the host mapping is active.
- Record the host address and mapped port that a process on the Coolify server can reach. The documented illustration is
http://localhost:4477;4477is an example, not a universal Coolify port.
Use the host-mapped port in the tunnel’s service URL. A container-only port can work from another container on the same Docker network yet return connection refused when cloudflared connects through the host.
Create the Cloudflare Tunnel
- Sign in to Cloudflare and open Networking > Tunnels.
- Select Create Tunnel.
- Give the tunnel a descriptive name, such as
coolify-prodorcoolify-pi. The name is for administration and does not determine the public hostname. - Select the operating system and CPU architecture of the server that will run
cloudflared. - Cloudflare displays an installation or run command containing a tunnel token. Copy the generated token into a password manager or another protected secret store.
Never put the token in a public repository, a screenshot, an article, or an unprotected environment file. Anyone who obtains it may be able to operate the connector for that tunnel. If it is exposed, revoke or rotate it in Cloudflare and update the connector.
Run cloudflared on the Coolify host
Option A: deploy it as a Coolify resource
- Create a Cloudflared resource in the Coolify project or server.
- Add the tunnel token as the resource’s environment variable, using the variable name expected by the Cloudflared resource or image you selected.
- Deploy the resource and wait for its logs to show a successful connection to Cloudflare.
- Keep the resource running whenever the published applications need to be available.
This option keeps the connector lifecycle, environment variables, and logs near the applications it serves. It also means a Coolify deployment or server outage can take down both the applications and their connector.
Option B: install the connector directly on the server
- Install the
cloudflaredpackage appropriate for the server operating system and architecture shown in Cloudflare’s tunnel setup screen. - Run the command Cloudflare generated with the complete tunnel token.
- Register it as a system service so it restarts after a reboot.
- Check the service logs and confirm that it maintains a connected session.
A directly installed connector can remain available independently of Coolify’s application deployments, but you must manage its package updates, service permissions, and secret storage yourself.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Add a published application route
- In the tunnel, open the Routes area and choose Add published application (the label may appear as Published application route).
- Enter the subdomain and select the Cloudflare-managed domain. For example, choose
appandexample.comto publishapp.example.com. - Set Service URL to the local address and port that reaches the intended origin.
- For an all-resources setup, use the Coolify proxy’s reachable address and exposed port.
- For a single-resource setup, use the mapped host port, such as
http://localhost:4477only when your server really maps that application to port4477. - Save the route and verify that the tunnel shows the route as active.
The service URL is viewed from the connector’s point of view. localhost means the machine or container in which cloudflared is running. If the connector is inside a container, confirm that its network namespace can reach the address you entered; the host loopback address inside a container is not automatically the physical server’s loopback address.
Configure DNS for the hostname
Cloudflare’s tunnel workflow supplies a tunnel target under cfargotunnel.com. In the DNS zone, create or accept the record for the published hostname so it targets that tunnel address and is proxied through Cloudflare. Follow the record format shown in the tunnel dashboard rather than manually guessing the target.
Recommended Free Tools
Do not create a second record with the same hostname pointing directly at the server’s public IP. That would bypass the tunnel and may expose the origin you were trying to protect. If an old record exists, remove or replace it after checking that no other service depends on it.
Ingress rules and the required catch-all
Cloudflare evaluates tunnel ingress rules in order. A hostname-specific rule must appear before a final catch-all rule. Cloudflare’s documented requirement is that ingress rules include a catch-all at the end; a typical final rule is:
service: http_status:404The catch-all gives unmatched hostnames a deliberate 404 instead of allowing an accidental or ambiguous match. In a locally managed configuration, place it last. If you add a new hostname rule below it, that rule will never be reached.
For dashboard-managed routes, inspect the generated configuration or route list when diagnosing a mismatch. Confirm spelling, subdomain, and domain exactly; www.example.com, example.com, and app.example.com are different hostnames.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Understand HTTPS at the edge versus TLS at the origin
Basic HTTP-origin pattern
In the common setup, a visitor establishes HTTPS with Cloudflare. Cloudflare then sends the tunnel request over HTTP to the local proxy or application, for example http://localhost:4477. The browser still sees an HTTPS URL, but the final hop inside your server is not encrypted. This is acceptable only when that local path and your application’s security requirements permit it.
Full origin TLS pattern
If the origin must receive HTTPS, configure the origin certificate name and TLS settings according to Coolify’s full-TLS procedure. The certificate hostname must match the hostname Cloudflare uses when connecting to the origin. A certificate for one name will not automatically validate a different internal or public name.
Changing the zone SSL mode by itself does not fix a certificate-name mismatch. Check the tunnel’s origin-server-name or equivalent TLS setting, the certificate’s names, and the service URL scheme together. A mismatch can produce an origin TLS error even though the public hostname and tunnel connector are healthy.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Test in a useful order
- In Cloudflare’s tunnel page, confirm the connector is healthy and connected.
- From the Coolify host, test the service URL locally. For example, request the mapped address and port with a browser or an HTTP client and verify that the expected application responds.
- Open the public hostname in a private browser window. A private window avoids a cached redirect or stale authentication cookie.
- Check the response’s hostname and certificate. The certificate should be for the public hostname, not an internal container name.
- Watch both cloudflared and Coolify logs while making a request. The logs should reveal whether the request reached the connector, which hostname was received, and which local port was attempted.
A healthy tunnel status proves only that Cloudflare can reach cloudflared. It does not prove that the service URL is correct or that the Coolify application is listening.
Troubleshoot by symptom
404 from the tunnel
- Check that the requested hostname exactly matches a published route or ingress rule.
- Confirm the catch-all rule exists and is last.
- For an all-resources setup, verify that Coolify has the same domain assigned to the target application.
- For a single-resource setup, make sure the request is going to the tunnel route you created rather than an old DNS record.
A 404 generally indicates routing, not a dead connector. First determine whether the 404 was generated by Cloudflare’s ingress rule, Coolify’s proxy, or the application itself by comparing the response headers and logs.
502, connection refused, or timeout
- Confirm that the application is deployed and listening.
- Replace a container-only port in the service URL with the host-mapped port.
- Verify that the connector can reach the address from its own network namespace.
- Check whether the local service expects HTTPS while the route uses
http://, or the reverse. - Inspect Coolify and cloudflared logs for the exact destination and refusal reason.
Coolify’s single-resource example uses http://localhost:4477 to emphasize the host mapping. Do not copy that number unless your deployment actually maps the application to it.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
TLS or certificate mismatch
- Confirm whether the origin is supposed to use HTTP or HTTPS.
- If it is HTTPS, ensure the origin certificate includes the hostname used for origin validation.
- Align the tunnel’s origin TLS name and settings with the certificate and Coolify’s full-TLS configuration.
- Do not expect a zone-wide SSL-mode change to repair a name mismatch.
The tunnel will not connect
- Check that the token is complete, has no accidental spaces or line breaks, and belongs to the intended tunnel.
- Verify outbound access to port
7844through the server firewall, cloud security group, and any egress proxy. - Confirm that the connector architecture and operating-system selection match the server.
- Review service logs for authentication or clock-related errors.
It worked until a redeploy
- Check whether the application’s host-port mapping changed.
- Confirm that the Coolify proxy or Cloudflared resource was not removed during the deployment.
- Verify that environment variables still contain the tunnel token and that the connector restarted.
- Recheck the public route if you changed the application’s domain.
HTTP applications versus SSH and other TCP services
Published application routes are designed for web traffic. SSH and other non-HTTP protocols require cloudflared on the server side and a Cloudflare-aware client connection on the user’s device. A browser pointed at an SSH route will not work, and simply selecting a different port in an HTTP published route does not turn it into a general TCP proxy.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Plan the client installation, authentication, and user instructions before exposing a non-HTTP service. Keep web hostname routes and client-assisted TCP access as separate configurations so a change to one does not unintentionally affect the other.
Security and operational checklist
- Use a dedicated hostname for each application or clearly document the proxy’s host-based routing.
- Store the tunnel token as a secret and rotate it if it is exposed.
- Keep the tunnel’s catch-all rule last.
- Expose only the mapped service ports you actually need.
- Do not add a direct public-IP DNS record for a hostname intended to use the tunnel.
- Decide explicitly whether the origin hop is HTTP or HTTPS.
- Apply authentication and application-level access controls; a tunnel removes inbound port forwarding but does not make an application safe by itself.
- Monitor connector, Coolify, and application logs after upgrades and redeployments.
- Back up the route names, mapped ports, domain assignments, and TLS settings so you can rebuild the connector.
Raspberry Pi and small local servers
A Raspberry Pi is a practical host for this architecture when the Coolify workload fits its CPU, memory, storage, and network capacity. The tunnel removes the need for a public router port, which is useful on residential connections or networks where inbound forwarding is unavailable. It does not remove the need to size the machine for the applications, databases, builds, and logs you plan to run.
On a small server, watch memory and storage closely: a connector can be healthy while the application is being killed by resource pressure. Keep the operating system, Coolify, application images, and cloudflared updated according to their supported release guidance, and test a reboot to verify that both Coolify and the connector return automatically.
A repeatable deployment checklist
- Choose all-resources or single-resource scope.
- Deploy and locally verify the Coolify application.
- Identify the connector’s reachable local address and the correct host-mapped port.
- Create the tunnel in Cloudflare and protect its token.
- Run
cloudflaredin Coolify or as a server service. - Allow outbound port
7844if the firewall restricts egress. - Create a published hostname route with the correct service URL.
- Ensure the proxied DNS record targets the tunnel’s
cfargotunnel.comaddress. - Add or verify the final
service: http_status:404catch-all. - Configure HTTP or full origin TLS deliberately.
- Test locally, then through the public hostname while watching logs.
What a successful result looks like
The tunnel dashboard shows a connected connector, the hostname resolves through a proxied Cloudflare record, and a request to the public HTTPS hostname reaches the intended Coolify service. In an all-resources deployment, Coolify’s proxy selects the application from the hostname. In a single-resource deployment, the route reaches the application’s mapped host port directly. No inbound router port is forwarded, and the origin’s public IP is not required in the application’s DNS record.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
