Automating Local and Staging Environments Safely with Cloudflare Zero Trust Tunnel and Access

Local Development Automation with Cloudflare Zero Trust Tunnel and Access

When developing webhooks (e.g. Stripe payment events or GitHub Actions CI triggers) on local machines or staging servers, developers frequently turn to tools like ngrok. However, ngrok introduces changing random URLs, session timeouts, subscription costs, and security risks by opening inbound firewall ports.

By combining Cloudflare Zero Trust Tunnel (cloudflared) with Cloudflare Access, engineering teams can establish permanent, highly secure tunnels to custom domains (dev.mycompany.com) without opening a single inbound port—completely for free.

This article details replacing ngrok with cloudflared, Docker Compose integration, Cloudflare Access OIDC (Google Workspace / GitHub SSO) authentication, bypassing webhooks via Service Tokens, and audit logging.

Key Takeaways

Zero Inbound Open Ports: cloudflared establishes outbound-only connections to Cloudflare edge nodes, eliminating inbound firewall vulnerabilities.

Fixed Custom Domains & SSL: Assign stable custom domain names (e.g., dev-alice.company.com) with managed, free Cloudflare SSL/TLS certificates.

Cloudflare Access SSO: Secure staging access with Google Workspace or GitHub SSO authentication.

Service Token Webhook Bypass: Authenticate automated CI/CD and payment webhooks directly via HTTP headers (CF-Access-Client-Id) without triggering interactive SSO logins.

ngrok vs. Cloudflare Zero Trust Tunnel

Feature	ngrok (Free/Pro)	Cloudflare Zero Trust Tunnel
Domain	Random subdomain (changes on restart)	Fixed Custom Domain (`dev.company.com`)
Firewall	Inbound port listening	Zero Inbound Ports (Outbound Only)
SSO & Auth	Basic Auth (Pro tier)	Google / GitHub / Okta OIDC SSO included free
Cost	$8 – $20 / user / month	Zero Trust Free Tier ($0 for up to 50 users)
DDoS Protection	Limited	Cloudflare Global L3/L4/L7 DDoS Protection

Quick Start: Installing cloudflared

# macOS Homebrew
brew install cloudflared

# Login and Create Tunnel
cloudflared tunnel login
cloudflared tunnel create dev-local-tunnel
cloudflared tunnel route dns dev-local-tunnel dev-api.mycompany.com

`config.yml` Example

tunnel: c8a3f81e-xxxx-xxxx-xxxx-xxxxxxxxxxxx
credentials-file: /Users/developer/.cloudflared/c8a3f81e-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json

ingress:
  - hostname: dev-api.mycompany.com
    service: http://localhost:3000
  - service: http_status:404

Docker Compose Integration

version: "3.8"

services:
  app:
    build: .
    ports:
      - "3000:3000"

  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}

Bypassing Access SSO for Webhooks with Service Tokens

For GitHub or Stripe webhooks, configure Cloudflare Access policies to allow bypass when valid Service Tokens are supplied in request headers:

CF-Access-Client-Id: xxxxxxx.access
CF-Access-Client-Secret: yyyyyyyy-secret-token

Rule 1 (Bypass): Action = Bypass | Include: Service Token -> Webhook-Token
Rule 2 (Allow): Action = Allow | Include: Emails ending in -> @mycompany.com

Conclusion

Replacing temporary tunnels with Cloudflare Zero Trust Tunnel & Access equips your team with fixed custom domains, robust SSO security, and seamless webhook integration at zero cost.