From 652c775998ce86d72203c7bd3241ce27bc01c2e9 Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Sat, 5 Sep 2026 02:42:12 +0200 Subject: [PATCH] refactor(cloudflared)!: read the tunnel token from a docker secret BREAKING CHANGE: Create the `cloudflared-tunnel-token` secret before deploying, then drop `CLOUDFLARED_TUNNEL_TOKEN` from `.env`. --- src/production/.env.template | 1 - src/production/cloudflared/compose.yaml | 8 +++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/production/.env.template b/src/production/.env.template index 8ffc032b..6dffbd15 100644 --- a/src/production/.env.template +++ b/src/production/.env.template @@ -1,4 +1,3 @@ -CLOUDFLARED_TUNNEL_TOKEN= SENTRY_CRONS= STACK_DOMAIN= TRAEFIK_ACME_EMAIL= diff --git a/src/production/cloudflared/compose.yaml b/src/production/cloudflared/compose.yaml index 88d76d15..93fff51f 100644 --- a/src/production/cloudflared/compose.yaml +++ b/src/production/cloudflared/compose.yaml @@ -1,3 +1,7 @@ +secrets: + cloudflared-tunnel-token: + # The secure tunnel's connector token. + external: true services: cloudflared: # You can configure the secure tunnel at [dash.cloudflare.com](https://dash.cloudflare.com/). @@ -10,7 +14,7 @@ services: environment: # The metrics server binds to the loopback interface because nothing outside the container reads it. TUNNEL_METRICS: 127.0.0.1:20241 - TUNNEL_TOKEN: ${CLOUDFLARED_TUNNEL_TOKEN} + TUNNEL_TOKEN_FILE: /run/secrets/cloudflared-tunnel-token healthcheck: # The image ships no shell and no HTTP client, so `cloudflared` probes itself. # It reads the metrics address from `TUNNEL_METRICS`, calls that server's readiness endpoint and exits non-zero while no connection to Cloudflare's edge is registered. @@ -20,3 +24,5 @@ services: retries: 3 start_period: 30s image: cloudflare/cloudflared:2026.8.3 + secrets: + - cloudflared-tunnel-token