is it possible to interface tunnels with workers?
is it possible to make calls from workers to tunnels without necessarily exposing the tunnels directly to the internet via a domain?
18 Replies
Not really, the closest you can get is protecting the tunnel hostnames with Access and adding a Service Token as a secret to the Worker
very interesting, i haven't worked with Access at all. can you give a quick summary of how that would be done? is there a library available to the workers that works with Access?
You just create a Service Token: https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/
And then add the ID and secret of the token to your Worker env/secrets and send all your requests with
CF-Access-Client-Id and CF-Access-Client-Secret headers
Its not the most perfect security in the world (relies on a static secret) but its as good as you can getalright, i've figured out how to create a service token. and I think i can figure out how to set those headers. but how do i set a tunnel to be protected by the service token?
As an aside, if you do this then make sure the tunnel Public Hostname as the "Protect with Access" option enabled has well as the Access policy existing https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/origin-configuration/#access-settings
ah, i see it:
Create a Self-hosted Access application covering the domain and create a policy with action "Service Auth"
You can then specify a certain service token in the "additional rules"
Or just yolo it and accept any:
what about session duration?
Its irrelevant for service auth policies
perfect, going to the tunnel in my browser is blocked. that's expected. tomorrow i will try through the worker
many thanks :dogekek:
Yep if the only policy is Service Auth then you get the nice
Forbidden pagethis is very convenient
There is also a setting to redirect it to another page instead
Under "Non-identity failure block page" in the Access application settings
Can’t you also just WAF block everything that isn’t your Worker?
Sure but you won't have the same added protections that you get from an Access JWT