Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsCloudflare Tunnel Multidomain —Secure Self-Hosted Deployment
Deploy and maintain multi-domain Cloudflare Tunnels with validated ingress routing and systemd hardening.
$38.99
Cloudflare Tunnel Multidomain —Secure Self-Hosted Deployment
Example session with this skill installed
I need to add two new services to my existing Cloudflare tunnel: a Jira instance at jira.internal:8080 and a wiki at wiki.internal:80. Both need Cloudflare Access. provide the config and hardening.
- Read your context and instructions
- Compiled the cloudflare tunnel multidomain
I have drafted the configuration update and hardening plan for your Cloudflare Tunnel. This plan includes explicit ingress rules for your new services and a security review for the systemd unit.
Tunnel Configuration and Hardening Plan
| Hostname | Origin URL | Access Policy | Environment | Owner |
|---|---|---|---|---|
| jira.example.com | http://jira.internal:8080 | Required (MFA) | Production | DevOps |
| wiki.example.com | http://wiki.internal:80 | Required (SSO) | Production | Internal Docs |
| * | http_status:404 | N/A | Global | System |
# Add to /etc/cloudflared/config.yml
ingress:
- hostname: jira.example.com
service: http://jira.internal:8080
- hostname: wiki.example.com
service: http://wiki.internal:80
- service: http_status:404
systemd Hardening Review
Apply these directives to /etc/systemd/system/cloudflared.service to enforce least privilege:
[Service]
User=cloudflared
Group=cloudflared
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
UMask=0077
Validation and Safe-Edit Steps
- Backup:
cp /etc/cloudflared/config.yml /etc/cloudflared/config.yml.bak - Permissions: Ensure
config.ymlis readable only by thecloudflareduser. - Validate: Run
cloudflared tunnel ingress validate. - Apply: Execute
systemctl reload cloudflared(check version compatibility for hot reload).
Next steps
- Verify that
cloudflaredhas read access to the tunnel credentials JSON after applying systemd hardening. - Test the catch-all rule by attempting to access an undefined subdomain.
- Implement the Cloudflare Access policies in the Zero Trust dashboard before directing traffic.
Connects securely to your tools. The creator never sees your data.
About this skill
Managing multi-domain Cloudflare Tunnels manually often leads to ingress routing errors, exposed origin services, or service downtime during configuration reloads. This skill provides a structured methodology for deploying and maintaining cloudflared instances across multiple hostnames while enforcing security best practices.
What it does
- Ingress routing maps hostnames to local or private origin services with explicit validation.
- Configuration management handles YAML updates with mandatory backups and atomic replacement.
- Security hardening applies systemd sandboxing including
NoNewPrivilegesand restricted filesystem access. - Validation cycles runs version-specific configuration checks before applying changes to production.
- Rollback planning defines specific recovery steps and maintains known-good configuration states.
How it works
- Inventory phase where you provide the hostname, origin URL, owner, and access policy for each service.
- Drafting phase where the agent generates the validated ingress rules and systemd service hardening directives.
- Deployment phase where the agent outlines the safe-edit sequence, backup steps, and version-specific reload commands.
- Verification phase where each hostname and the catch-all rule are tested against expected health-check behavior.
Frameworks & tools
This skill works with cloudflared, Cloudflare Zero Trust, Linux systemd, and YAML configuration structures.
Why this beats prompting it yourself
Generic prompts often overlook the final catch-all rule required for tunnel safety or fail to account for version-specific cloudflared reload behaviors. This skill enforces a strict verification and rollback loop, ensuring you never push a broken ingress map that takes down existing services.
Use cases
- Adding new microservices to an existing Cloudflare Tunnel without downtime.
- Hardening existing
cloudflaredsystemd units with least-privilege security controls. - Transitioning from single-domain to multi-domain routing structures.
- Auditing existing tunnel configurations for exposed admin panels or missing Access policies.
Known limitations
Does not automate the initial Cloudflare account setup or DNS record creation. Requires manual execution of commands on the host machine.
Requires manual command execution. Does not automate initial account/tunnel creation or DNS records. Limited to systemd-based Linux environments for hardening features.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 24 days ago