Cloudflare Gateway

Use this page to set up the gateway. To see it from your CI Account, or to remove a device, see Cloudflare Gateway management.

The Cloudflare Gateway exposes Companion Hub apps through a managed tunnel and does not require manual port forwarding.

What is it?

A managed Cloudflare Tunnel, provisioned for you through your CI Account at hub.ci.computer when you pair your Hub. Hub runs a cloudflared container that dials out to Cloudflare and holds the connection open. Public traffic arrives at Cloudflare and is passed down that existing tunnel to your Hub.

In the Hub’s own screens this is called Public Web: it is one of three Exposure mode choices for an app, next to Private VPN and This Machine Only.

Because the connection is outbound, your router never needs an open inbound port.

A request from the public internet crosses four hops, and the only one that touches your router is a connection your Hub opened itself:

flowchart TB
    subgraph internet["Public internet"]
        direction LR
        B["Browser<br/>anyone with the URL"] -->|"HTTPS, certificate from Cloudflare"| CF["Cloudflare's network<br/>DDoS protection"]
    end
    subgraph hub["Your Hub"]
        direction LR
        CD["cloudflared container"] --> TR["Traefik<br/>Hub reverse proxy"]
        TR -->|"only apps you exposed"| APP["Exposed app<br/>its own login"]
    end
    internet <-->|"Cloudflare Tunnel: cloudflared dials out and holds it open, so your router needs no inbound port; public traffic is passed down it"| hub

Everything else on the Hub stays local: an app you have not exposed has no public URL, so nothing reaches it through the tunnel.

Benefits

No port forwarding — your router stays locked down
Automatic HTTPS — certificates are handled by Cloudflare
DDoS protection — Cloudflare’s network sits in front of your apps
Managed for you — no Cloudflare account or configuration needed
Set up by pairing — your CI Account provisions the tunnel and DNS when you pair the Hub

Before you start

Your Hub needs outbound internet access — it dials out to Cloudflare
You need a CI Account at hub.ci.computer
Exposing an app makes it reachable by anyone with the URL. Make sure the app has its own authentication before you expose it.
When the tunnel is up, the install form selects Public Web by default, and it switches on Enable authentication for apps that support it. Check the Exposure mode each time you install.

Do not expose an app that has no login, or one still using default credentials. The gateway secures the transport, not the application behind it.

Setup

Pair your Hub

Pair your Hub with your CI Account. The gateway is provisioned per-device, so this has to come first. Provisioning takes a few minutes; keep the Hub’s registration page open until it finishes.

Check that the tunnel is active

On the Hub, open Settings → Network. The Cloudflare Tunnel card reads Active and shows a Tunnel ID. No Cloudflare account of your own is involved, and there is no separate switch to turn the gateway on.

If the card reads Inactive, or the Hub shows Remote access is offline, select Reconnect on the banner, or see Troubleshooting.

Verify the tunnel is up


cihub status

The output reports the Cloudflare tunnel state, along with the containers, Tailscale, and models. You can also confirm the container is running:


docker ps --filter name=cloudflared

Expose an app

Choose which apps to expose from your Hub dashboard. In an app’s install form or its settings, set Exposure mode to Public Web and save. From your CI Account, the store’s Install dialog has the same choice under Access method. Each exposed app gets a public URL of the form <app>-<device>-<organization>.<zone>. Your CI Account picks the zone when you pair the Hub: a new Hub gets a short zone such as ci0.pw, and Hubs paired earlier can still use ci.computer.

Only apps whose Exposure mode is Public Web are reachable. Everything else stays local.

Turning it off

To stop exposing an app, open its settings, set Exposure mode to This Machine Only or Private VPN, and save. The Hub syncs the change to your account and the public URL stops working.

To stop the tunnel for the whole Hub, go to Settings → Network → This Hub in your account → Reset this Hub only. That stops the cloudflared container and clears the pairing, so the Hub is reachable on your local network and over Tailscale only. Your CI Account keeps the device, so a code from Regenerate pairing code brings the same tunnel back.

Troubleshooting

Symptom	What to do
Remote access is offline banner on the Hub	Select Reconnect. If it asks you to restart the Hub or pair again, follow the message
App is running but its public URL shows an error	Open the app’s settings on the Hub and select Repair routing. From a CI-Hub source checkout, `cihub public-web status` and `cihub public-web repair` do the same from a terminal
The Cloudflare Tunnel card reads Inactive after pairing	Wait a few minutes for DNS and the tunnel to finish, then check outbound internet access

If tunnel state gets stuck after unpairing, see Remove tunnel token manually.

Self-managed Cloudflare tunnels

To use your own Cloudflare account and tunnels, see Expose apps with Cloudflare tunnels. You manage DNS yourself and retain full control of the Cloudflare configuration.

What your CI Account shows about the tunnel, and how to remove a device.

Gateway in your CI Account

Private access instead of public URLs.

Tailscale