From ec8abad26753ef55f9436b76eb4b5eaf39ee1b0a Mon Sep 17 00:00:00 2001 From: Brenner-Bot Date: Sun, 25 Sep 2022 16:23:58 +0000 Subject: [PATCH] :tada: Release of add-on Cloudflared 3.0.0 --- README.md | 6 +- cloudflared/CHANGELOG.md | 17 ++++-- cloudflared/DOCS.md | 97 +++++++++++--------------------- cloudflared/config.yaml | 4 +- cloudflared/translations/en.yaml | 10 ---- 5 files changed, 49 insertions(+), 85 deletions(-) diff --git a/README.md b/README.md index 01b5186..2c7bdb2 100644 --- a/README.md +++ b/README.md @@ -86,10 +86,10 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -[addon-cloudflared]: https://github.com/brenner-tobias/addon-cloudflared/tree/v2.0.18 -[addon-doc-cloudflared]: https://github.com/brenner-tobias/addon-cloudflared/blob/v2.0.18/README.md +[addon-cloudflared]: https://github.com/brenner-tobias/addon-cloudflared/tree/v3.0.0 +[addon-doc-cloudflared]: https://github.com/brenner-tobias/addon-cloudflared/blob/v3.0.0/README.md [cloudflared-issue]: https://github.com/brenner-tobias/addon-cloudflared/issues -[cloudflared-version-shield]: https://img.shields.io/badge/version-v2.0.18-blue.svg +[cloudflared-version-shield]: https://img.shields.io/badge/version-v3.0.0-blue.svg [cloudflared-aarch64-shield]: https://img.shields.io/badge/aarch64-yes-green.svg [cloudflared-amd64-shield]: https://img.shields.io/badge/amd64-yes-green.svg [cloudflared-armhf-shield]: https://img.shields.io/badge/armhf-yes-green.svg diff --git a/cloudflared/CHANGELOG.md b/cloudflared/CHANGELOG.md index 13f8702..0c1f0f4 100644 --- a/cloudflared/CHANGELOG.md +++ b/cloudflared/CHANGELOG.md @@ -1,8 +1,15 @@ ## What’s changed + +We want to reduce the complexity of this add-on and acknowledge the new possibilities for Managed Tunnels in the Cloudflare Dashboard with the next releases. + +Therefore, we want to validate the necessity of some of the add-on options and kindly ask everyone to participate in [this very quick survey](https://github.com/brenner-tobias/addon-cloudflared/discussions/191). Thank you all very much! + +We already started with some simplifications: + +## 🚨 Breaking changes + +- Remove "reset-cloudflared_files" and "quick_tunnel" options @brenner-tobias (#192) + ## 📚 Documentation -- Tidy add-on description @AlecRust (#184) - -## ⬆️ Dependency updates - -- ℹ️ Update Cloudflared to version 2022.9.1 @github-actions (#185) +- Update docs with mentions of security @AlecRust (#189) diff --git a/cloudflared/DOCS.md b/cloudflared/DOCS.md index 20a2843..775fa18 100644 --- a/cloudflared/DOCS.md +++ b/cloudflared/DOCS.md @@ -17,16 +17,6 @@ Please make sure to be compliant with the add-on. Especially [section 2.8][cloudflare-sssa-28] could be breached when mainly streaming videos or other Non-HTML content. -## Quick Tunnel for Testing - -You can get started with zero setup by using -[Cloudflare Quick Tunnels](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare). - -See [below](#option-quick_tunnel) for the detailed configuration. - -**Please note that it is not recommended to use the quick tunnel for production -use since the URL can change anytime.** - ## Installation The installation of this add-on is pretty straightforward but requires some prerequisites @@ -42,25 +32,6 @@ and a manual step at the first set-up. [Domain Name and Cloudflare Set-Up](#domain-name-and-cloudflare-set-up) for details. 1. **Decide whether to use a [local or managed tunnel][addon-remote-or-local].** -### Securing Access to the Cloudflare Account - -The Add-on downloads after authentication a `cert.pem` file to authenticate -your instance of cloudflared against your Cloudflare account. -You can not revoke access to this file from your Cloudflare account! -The [issue](https://github.com/cloudflare/cloudflared/issues/93) -still persists. - -Workaround: - -1. Create a new Cloudflare account and invite it to your Cloudflare account - that manages your Domain:\ - Cloudflare Dashboard -> Manage Account -> Members -> Invite Member -1. Instead of using your primary account to authenticate the tunnel, - use your secondary account. - -If your `cert.pem` file is compromised, you can revoke your -secondary account from your primary account. - ### Initial Add-on Setup for local tunnels The following instructions describe the minimum necessary steps to use this add-on: @@ -77,7 +48,7 @@ The following instructions describe the minimum necessary steps to use this add- 1. A tunnel and a DNS entry will be created and show up in your Cloudflare DNS / Teams dashboard. -Please review the rest of this site for further information and more +Please review the rest of this documentation for further information and more advanced configuration options. ## Configuration @@ -88,13 +59,11 @@ Please check the index below for further information. - [`additional_hosts`](#option-additional_hosts) - [`catch_all_service`](#option-catch_all_service) - [`nginx_proxy_manager`](#option-nginx_proxy_manager) -- [`quick_tunnel`](#option-quick_tunnel) - [`data_folder`](#option-data_folder) - [`custom_config`](#option-custom_config-advanced-option) - [`warp_enable`](#option-warp_enable-advanced-option) - [`warp_routes`](#option-warp_routes) - [`log_level`](#option-log_level) -- [`reset_cloudflared_files`](#option-reset_cloudflared_files) - [`warp_reset`](#option-warp_reset) - [`tunnel_token`](#option-tunnel_token) @@ -211,25 +180,6 @@ or directly to the tunnel URL that you can get from the CNAME entry of Finally, you have to set-up your proxy hosts in Nginx Proxy Manager and forward them to wherever you like. -### Option: `quick_tunnel` - -You can get started with zero setup by using -[Cloudflare Quick Tunnels](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare). -Set `quick_tunnel` to `true` , all other configuration will be ignored. After -starting the addon, check the logs for your unique randomly generated -`trycloudflare.com` URL. -Please note that you still have to add the `http` integration settings to your -HA-config as described [here](#configurationyaml). - -Quick Tunnel add-on configuration: - -```yaml -quick_tunnel: true -external_hostname: "" -tunnel_name: "" -additional_hosts: [] -``` - ### Option: `data_folder` The `data_folder` option allows to change the default storage @@ -367,19 +317,6 @@ more severe level, e.g., `debug` also shows `info` messages. By default, the `log_level` is set to `info`, which is the recommended setting unless you are troubleshooting. -### Option: `reset_cloudflared_files` - -In case something went wrong or you want to reset your Cloudflare Tunnel -for some other reason (e.g., switch to another Cloudflare account), you can reset -all your local Cloudflare files by setting this option to `true`. - -```yaml -reset_cloudflared_files: true -``` - -**Note**: _After deleting the files, the option `reset_cloudflared_files` will -automatically be removed from the add-on configuration._ - ### Option: `warp_reset` In case something went wrong or you no longer want to use this add-on to @@ -425,6 +362,37 @@ Make sure to add the [trusted proxy setting](#configurationyaml) correctly. Make sure to copy and paste the code snippet without adapting anything. There is no need to adapt IP ranges as the add-on is working as proxy. +## Securing access to the Cloudflare account + +The add-on downloads after authentication a `cert.pem` file to authenticate +your instance of cloudflared against your Cloudflare account. +You can not revoke access to this file from your Cloudflare account! +The [issue](https://github.com/cloudflare/cloudflared/issues/93) +still persists. + +Workaround: + +1. Create a new Cloudflare account and invite it to your Cloudflare account + that manages your Domain:\ + Cloudflare Dashboard -> Manage Account -> Members -> Invite Member +1. Instead of using your primary account to authenticate the tunnel, + use your secondary account. + +If your `cert.pem` file is compromised, you can revoke your +secondary account from your primary account. + +## Securing access to Home Assistant + +After your tunnel is setup and working, you may wish to add additional security +measures. + +For example you could add a [WAF rule](https://developers.cloudflare.com/waf/) in +Cloudflare which blocks requests outside your country. + +You can also use Cloudflare Access to present an authentication page before users +are able to access Home Assistant, see the +[self-hosted applications][self-hosted-applications] docs. + ## Domain Name and Cloudflare Set-Up To use this plugin, you need a domain name that is using Cloudflare for its @@ -483,5 +451,6 @@ SOFTWARE. [cloudflared-route-st]: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/private-net#optional-ensure-that-traffic-can-reach-your-network [remote-managed-tunnel]: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/#set-up-a-tunnel-remotely-dashboard-setup [create-remote-managed-tunnel]: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/#1-create-a-tunnel +[self-hosted-applications]: https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-apps/ [addon-remote-tunnel]: https://github.com/brenner-tobias/addon-cloudflared/blob/main/docs/remote-tunnel.md [addon-remote-or-local]: https://github.com/brenner-tobias/addon-cloudflared/blob/main/docs/tunnels.md diff --git a/cloudflared/config.yaml b/cloudflared/config.yaml index cac9c92..29f2267 100644 --- a/cloudflared/config.yaml +++ b/cloudflared/config.yaml @@ -32,8 +32,6 @@ schema: external_hostname: str? log_level: list(trace|debug|info|notice|warning|error|fatal)? nginx_proxy_manager: bool? - quick_tunnel: bool? - reset_cloudflared_files: bool? tunnel_name: str? tunnel_token: str? warp_enable: bool? @@ -42,4 +40,4 @@ schema: - str? slug: cloudflared url: https://github.com/brenner-tobias/addon-cloudflared/ -version: 2.0.18 +version: 3.0.0 diff --git a/cloudflared/translations/en.yaml b/cloudflared/translations/en.yaml index 9ac9bde..5ff20d0 100644 --- a/cloudflared/translations/en.yaml +++ b/cloudflared/translations/en.yaml @@ -29,16 +29,6 @@ configuration: description: >- Sets the catch-all service to the "Nginx-Proxy-Manager Community Add-Ons" Add-On. - quick_tunnel: - name: Enable Quick Tunnel - description: >- - Enables the Cloudflare Quick Tunnel for this instance. All other options - will be ignored. - reset_cloudflared_files: - name: Reset Cloudflared files - description: >- - When enabled, the add-on configuration will be reset upon next add-on - start. data_folder: name: Custom Data Folder description: >-