Cloudflare Gateway

This is the complete setup guide. For managing an already-configured gateway from your account, see Cloudflare Gateway Management.

The Cloudflare Gateway is the recommended way to expose Companion Hub apps to the internet. It is the simplest and safest option, and it does not require manual port forwarding.

What is it?

A managed Cloudflare Tunnel, provisioned for you through your CI Account at hub.ci.computer. Hub runs a cloudflared container that dials out to Cloudflare and holds the connection open. Public traffic arrives at Cloudflare and is passed down that existing tunnel to your Hub.

Because the connection is outbound, your router never needs an open inbound port.

Benefits

No port forwarding — your router stays locked down
Automatic HTTPS — certificates are handled by Cloudflare
DDoS protection — Cloudflare’s network sits in front of your apps
Managed for you — no Cloudflare account or configuration needed
One-click setup — enable from hub.ci.computer

Before you start

Your Hub needs outbound internet access — it dials out to Cloudflare
You need a CI Account at hub.ci.computer
Exposing an app makes it reachable by anyone with the URL. Make sure the app has its own authentication before you expose it.

Do not expose an app that has no login, or one still using default credentials. The gateway secures the transport, not the application behind it.

Setup

Pair your Hub

Pair your Hub with your CI Account. The gateway is provisioned per-device, so this has to come first.

Enable the Gateway

At hub.ci.computer , navigate to your device and click Enable Gateway. The tunnel is provisioned automatically — no Cloudflare account of your own is involved.

Verify the tunnel is up


cihub status

The output includes a tunnel URL once the gateway is active. You can also confirm the container is running:


docker ps --filter name=cloudflared

Expose an app

Choose which apps to expose, from either your Hub dashboard or your CI Account. Each gets a public URL under your configured domain.

Only apps you explicitly expose are reachable. Everything else stays local.

Turning it off

Unexposing an app removes its public URL immediately. Disabling the gateway entirely stops the tunnel container, and your Hub reverts to LAN-only access.

If tunnel state gets stuck after unpairing, see Remove tunnel token manually.

Self-managed Cloudflare tunnels

Prefer to run your own Cloudflare account and tunnels? See Expose apps with Cloudflare tunnels. You give up the one-click setup and manage DNS yourself, but you keep full control of the Cloudflare configuration.

Day-to-day control from your CI Account.

Manage the gateway

Private access instead of public URLs.

Tailscale