自建内网服务并使用 Cloudflare Tunnel 反向代理

配置 CF Tunnel 的 systemd 服务，使用 http2 协议以便于前面套透明代理。

# /etc/systemd/system/cloudflared.service
[Unit]
Description=Cloudflare Tunnel
After=network.target

[Service]
TimeoutStartSec=0
Type=notify
ExecStart=/usr/bin/cloudflared --protocol http2 --config /etc/cloudflared/config.yaml --no-autoupdate tunnel run <tunnel-name>
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

使用 Caddy 配合 Cloudflare 插件自动申请 HTTPS 证书

gist.example.com {
  reverse_proxy localhost:3700
  tls {
    dns cloudflare {env.CLOUDFLARE_API_TOKEN}
  }
}

vw.example.com {
  reverse_proxy localhost:3701
  tls {
    dns cloudflare {env.CLOUDFLARE_API_TOKEN}
  }
}

ha.example.com {
  reverse_proxy localhost:8123
  tls {
    dns cloudflare {env.CLOUDFLARE_API_TOKEN}
  }
}

alist.example.com {
  reverse_proxy localhost:3703
  tls {
    dns cloudflare {env.CLOUDFLARE_API_TOKEN}
  }
}

参考 https://community.cloudflare.com/t/use-sni-while-creating-a-tunnel-to-a-service/394268 配置 Tunnel

- hostname: gist.example.com
  service: https://localhost
  originRequest:
    originServerName: gist.example.com
    noTLSVerify: true