Skip to main content

Cloudflare Tunnels (Recommended)

Cloudflare Tunnels allow you to expose your Cyrus Panel instance securely to the internet without opening inbound ports on your firewall or exposing your server's public IP address. SSL is automatically terminated and managed by Cloudflare.

Why Use Cloudflare Tunnels?​

  • No Port Forwarding: No need to open ports 80 or 443 on your host firewall.
  • Full DDoS Mitigation: All traffic is proxied through Cloudflare's global edge network before reaching your host.
  • Automatic SSL: Cloudflare manages and auto-renews SSL/TLS certificates for your domain.
  • Hidden Origin IP: Completely hides your server's public IPv4 address.

Step 1: Install cloudflared on the Panel Server​

Connect to your server via SSH and install the official Cloudflare tunnel client (cloudflared):

Debian / Ubuntu​

# Add Cloudflare's package signing key
sudo mkdir -p --mode=0755 /etc/apt/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /etc/apt/keyrings/cloudflare-main.gpg >/dev/null

# Add repository to apt sources
echo "deb [signed-by=/etc/apt/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list

# Update repositories and install cloudflared
sudo apt update
sudo apt install -y cloudflared

RHEL / Fedora / AlmaLinux / Rocky Linux​

sudo dnf install -y 'https://pkg.cloudflare.com/cloudflared-ascii.repo'
sudo dnf install -y cloudflared

Arch Linux​

sudo pacman -S cloudflared

Step 2: Create a Tunnel in Cloudflare Zero Trust​

  1. Navigate to the Cloudflare Zero Trust Dashboard.
  2. In the left navigation sidebar, go to Networks → Tunnels.
  3. Click Add a tunnel (or Create a Tunnel).
  4. Select Cloudflared as the connector type and click Next.
  5. Enter a tunnel name (e.g. cyrus-panel-tunnel) and click Save tunnel.
  6. Under Install and run a connector, select your server OS (e.g. Debian/Ubuntu 64-bit).
  7. Copy the generated installation command (starts with sudo cloudflared service install ...) and execute it in your server terminal to register and start the daemon.
  8. Once the connector status on the webpage changes to Connected with a green status indicator, click Next.

Step 3: Configure Tunnel Routing​

Option 1: During New Tunnel Creation ("Route tunnel")​

After clicking Next in the step above, you will be on the Route tunnel step:

  1. Under the Public Hostname section:
    • Subdomain: Enter your desired subdomain (e.g. panel).
    • Domain: Select your registered domain from the dropdown (e.g. example.com).
    • Path: Leave empty.
  2. Under the Service section:
    • Type: Select HTTP.
    • URL: Enter localhost:57777 (or 127.0.0.1:57777).
  3. Click Save tunnel (or Save hostname).

Option 2: Adding to an Existing Tunnel​

If you already have a tunnel created:

  1. Go to Networks → Tunnels and select your tunnel.
  2. Switch to the Published application routes tab.
  3. Click Add a published application route.
  4. Configure the route:
    • Subdomain: panel
    • Domain: example.com
    • Service Type: HTTP
    • URL: localhost:57777
  5. Click Save.
Default Cyrus Panel Port

57777 is the default port Cyrus Panel runs on. If you changed the port in your panel .env file, replace 57777 with your custom port.

Step 4: Update Panel Configuration​

Update your panel environment file so callback URLs, WebSocket connections, and redirects use your new public domain:

  1. Open your panel .env file:
nano /var/www/cyrus/.env
  1. Update PANEL_URL with your full Cloudflare HTTPS address:
PANEL_URL=https://panel.example.com
  1. Restart the panel service to apply changes:
sudo systemctl restart cyrus-panel
# Or if running via PM2:
pm2 restart cyrus-panel

You can now access your Cyrus Panel securely at https://panel.example.com!