> ## Documentation Index
> Fetch the complete documentation index at: https://nextjs-egg.nyxel.my.id/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare Tunnel

> Expose your Next.js app publicly without opening firewall ports using Cloudflare Zero Trust.

A Cloudflare Tunnel creates an outbound-only connection from your server to Cloudflare's network. Traffic reaches your app through Cloudflare without requiring you to open any inbound firewall ports or expose your server's IP address.

When `CLOUDFLARE_TOKEN` is set, the egg downloads the `cloudflared` binary at startup, then runs the tunnel in the background alongside your Next.js app.

<Warning>
  The `cloudflared` binary is downloaded at startup if not already present. Your server must have outbound internet access for this to succeed.
</Warning>

## Prerequisites

* A Cloudflare account with **Zero Trust** enabled
* A tunnel created and configured in the Cloudflare dashboard

## Steps

<Steps>
  <Step title="Open the Zero Trust dashboard">
    Go to the [Cloudflare Zero Trust dashboard](https://one.dash.cloudflare.com/) and navigate to **Networks → Tunnels**.
  </Step>

  <Step title="Create or select a tunnel">
    Click **Create a tunnel** (or open an existing one). Choose **Cloudflared** as the connector type and follow the prompts to name your tunnel.
  </Step>

  <Step title="Copy the run token">
    After creating the tunnel, Cloudflare displays a **Run token** in the tunnel's configuration page. Copy this value.
  </Step>

  <Step title="Set the token in the panel">
    In your server's startup variables, set `CLOUDFLARE_TOKEN` to the token you copied.
  </Step>

  <Step title="Configure the public hostname">
    In the tunnel configuration, add a **Public Hostname** that points to `localhost` on your server's `SERVER_PORT`. For example:

    | Field    | Value                    |
    | -------- | ------------------------ |
    | Hostname | `app.yourdomain.com`     |
    | Service  | `http://localhost:25565` |

    Replace `25565` with the port assigned to your server.
  </Step>

  <Step title="Start the server">
    Start (or restart) your server. The egg installs `cloudflared` automatically if needed, then starts the tunnel in the background before launching Next.js.
  </Step>
</Steps>

<Note>
  The tunnel runs in the background as a separate process. Your Next.js app still binds to `SERVER_PORT` internally — the tunnel forwards external traffic to that port.
</Note>

<Tip>
  Leave `CLOUDFLARE_TOKEN` empty to disable the tunnel entirely. The egg skips the `cloudflared` install and startup steps when no token is set.
</Tip>