← Back to Archive
Archive Case Study

Cloudflare Tunnel Case Study

How an AI coding agent turned a short plan into a verified tunnel setup, reduced manual choreography, and left a public write-up free of live secrets.

Public version only. Real account numbers, tunnel IDs, zone IDs, and hostnames are replaced with placeholders such as example.com, <TUNNEL_ID>, and <ZONE_ID>.

The Challenge

Expose a local web service to the public internet through Cloudflare Tunnel. The usual path means reading docs, stitching API calls, writing exact config files, and verifying that DNS and the tunnel process agree.

What Actually Happened

Human effort: approve the plan when prompted.

Everything else: discovery, tunnel creation, DNS wiring, local config generation, container launch, and verification.

Execution Outline

  1. API discovery — resolve the Cloudflare zone and account context needed for later calls.
  2. Tunnel creation — create a tunnel ready for DNS and ingress wiring.
  3. DNS configuration — create a CNAME that points a hostname on example.com at the tunnel endpoint.
  4. Local configuration — generate ingress rules with placeholder IDs only in this public retelling.
  5. Container deployment — start a tunnel process so the published hostname can resolve through Cloudflare.
  6. Verification — confirm registered connections and a successful HTTPS response from the published hostname.

Placeholder Shape

Hostname app.example.com
Tunnel <TUNNEL_ID>
Zone <ZONE_ID>
Endpoint <TUNNEL_ID>.cfargotunnel.com

Illustrative Config Shape

tunnel: <TUNNEL_ID>

ingress:
  - hostname: app.example.com
  - service: http_status:404

Why It Matters

  • Context retention across multi-step infrastructure work.
  • Tool orchestration across API, filesystem, container, and verification steps.
  • Adaptive recovery when a preferred helper tool is missing.
  • Verification built into the workflow instead of treated as an afterthought.

Result

A task that often takes half an hour of documentation, dashboard clicks, and config surgery became a short supervised agent run. The public lesson is the workflow, not the private identifiers.