The Foldr server includes built-in support for Cloudflare Tunnel, giving you a fast and simple way to provide secure access to Foldr from outside the organisation without touching corporate firewalls or routers (no 1:1 NAT mapping or port forwarding required).
Cloudflare Tunnel works by allowing a server such as Foldr to create a secure outbound tunnel to the Cloudflare network, and Cloudflare’s own systems and DNS infrastructure then provide access via a public hostname of your choosing. The tunnel itself is created by a locally installed daemon called cloudflared, which is included on the Foldr server from update v5.5.0.1 onwards and kept up to date through the main Foldr server updates.
Setup is smoothest if your organisation’s DNS is managed by Cloudflare, as tunnel creation and DNS entries are then handled automatically, but this isn’t mandatory: Cloudflare Tunnel can also be used where DNS is managed by another provider, which Cloudflare refers to as a partial setup rather than a ‘full setup’.
Using Cloudflare Tunnel also means users automatically get a trusted SSL certificate when they connect to Foldr’s external / public address. The Foldr server can happily run an untrusted / self-signed certificate internally, while connections from outside are secured by a certificate that Cloudflare manages for you.
More information is available in Cloudflare’s Tunnel documentation.
Limitations
Cloudflare Tunnel is available on both free and paid Cloudflare accounts. The main limitation of the free tier when used with Foldr is the 100MB file upload limit.
Let’s Encrypt certificates installed directly on the Foldr server (under Foldr Settings > Security > Certificates) can’t be used with Cloudflare Tunnel, as Cloudflare redirects all HTTP traffic on port 80 and Let’s Encrypt’s domain validation fails as a result. This isn’t something you need to work around: Cloudflare manages the certificate for the server’s public HTTPS hostname and installs and renews it automatically, with no additional configuration needed.
Setup
Sign in to the Cloudflare Zero Trust dashboard at https://one.dash.cloudflare.com/. You can also reach it from the main Cloudflare dashboard, using the Zero Trust link in the left-hand panel.
If this is the first time your administrative account has accessed Zero Trust, Cloudflare will prompt you to create a unique team name. Choose one that suits your organisation and click Next.
You’ll then be prompted to choose a plan. The free tier on the far left is fine for most deployments; note that the ‘50 user’ limit refers to Cloudflare-registered users that policies can be applied to, not Foldr users. If your organisation needs a different tier, select that instead.
Confirm the selection on the summary screen and select Proceed to payment.
In the Zero Trust dashboard, select Networks > Tunnels, then click the + Create a tunnel button.
Select Cloudflared as the connector type and click Next.
Give the tunnel a suitable name and click Save tunnel.
On the Install connector step, select the Red Hat button.
Scroll down and copy the highlighted sudo cloudflared service install command. There’s no need to run any of the installation commands themselves, as cloudflared is already installed on the Foldr server; the command is simply the easiest way to copy the tunnel token.
In a new browser tab, go to Foldr Settings > Appliance > Network > Tunnel, enable the integration toggle and paste the copied command into the Token box.
Click Save Changes.
Back on the Cloudflare tunnel configuration page, the connector for Foldr should now appear with a status of ‘Connected’, along with its details at the bottom of the page.
Click Next.
The Public Hostnames screen is where you choose the address users will use to reach Foldr. In the example below, Foldr will be made available at https://myfiles.foldr.cloud
Choose the subdomain (myfiles in this example) and domain (foldr.cloud), leaving the optional Path blank.
Set the Service Type to HTTPS.
Set the URL to localhost, as cloudflared runs locally on the Foldr server.
Under the Service Type and URL fields, click Additional application settings > TLS and enable the following options:
No TLS Verify
HTTP2 connection
Note: if a trusted signed certificate is already installed on the Foldr server, No TLS Verify isn’t required. Bear in mind that Let’s Encrypt certificates aren’t suitable on a Foldr server behind Cloudflare (renewals fail because of Cloudflare’s catch-all port 80 redirect), so a certificate from a traditional certificate authority such as GoDaddy, Verisign or Sectigo would be needed instead.
Click Save tunnel.
The Tunnels summary screen (on the Zero Trust dashboard) should now show the newly configured tunnel with a green ‘Healthy’ status, as below.
The Foldr server should now be accessible externally via the tunnel, using the public hostname you configured. In this example, myfiles.foldr.cloud.
Note that the connection is secured by a Cloudflare-managed SSL/TLS certificate.
Presenting Foldr Settings (Foldr v4-v9) via Cloudflare Tunnel
This section only applies to legacy Foldr servers, up to and including v9.x, where Foldr Settings runs on a custom port (30537).
Exposing Foldr Settings (the web admin UI) to the internet isn’t generally recommended, but should you wish to access it this way, create an additional public hostname with a unique subdomain, pointed at HTTPS (service type) localhost:30537 (note the :30537).
In Tunnels, open the Public Hostname tab and select the + Add a public hostname button, then configure the hostname as in the example below.
Click Save hostname.
The additional hostname will then be displayed in the tunnel summary, and Foldr Settings should be accessible via the hostname you configured.
