Server SSH Access via Cloudflare Tunnels
Accessing your server using SSH over a Cloudflare Tunnel is a secure and easy way to connect to a remote server while keeping its IP address hidden.
Who this is for?
This setup is ideal for people who:
- Want to keep their server's IP address private.
- Want to close SSH ports on their server.
- Don’t want to rely on static public IPs for accessing their remote server.
- Don't have a static public IP for the server (only applies if you're doing the manual setup).
Before We Start
- We assume you already have a server running Coolify and you are looking to set up a tunnel to connect a different server to Coolify.
- If you are trying to set up a tunnel on the server where Coolify is running and you don’t have any other servers to connect, you don’t need a SSH tunnel. Coolify already has full root access to the server it’s running on, so there’s no need for an SSH tunnel in this case.
How It Works?
A simple high-level overview diagram to give you a visual idea of how this works:
Setup Methods
Choose how the tunnel is managed:
- Managed API: Coolify creates the tunnel, SSH route, DNS record, and connector using a Cloudflare API token.
- Existing tunnel: Create the tunnel and route in Cloudflare, then let Coolify install the connector using its tunnel token.
- Manual: Install and configure the connector yourself, then mark the setup complete in Coolify.
These tunnels carry SSH traffic. Application HTTP traffic uses separate resource tunnel configuration.
Create and manage the tunnel from Coolify
The remote server must already have a working SSH connection in Coolify so Coolify can install the connector. Keep direct access available until you have verified the tunnel connection.
Add a Cloudflare integration token
Create a Cloudflare API token with these permissions:
| Permission | Scope |
|---|---|
| Account > Cloudflare Tunnel > Edit | The account that owns the hostname's zone. |
| Zone > DNS > Edit | The zone containing the SSH hostname. |
| Zone > Zone > Read | The same zone, so Coolify can discover it. |
In Coolify, open Keys & Tokens > Integration Tokens, add a Cloudflare token, and select DNS and Cloudflare Tunnel capabilities. Selecting the tunnel capability also requires DNS. Validate and save the token in the team that owns the server.
Set up the tunnel
- Open Servers > [server] > Cloudflare Tunnel.
- Select the saved Cloudflare token, or add one from the form.
- Enter SSH hostname, such as
ssh.example.com, without a protocol. It must belong to a zone the token can manage. - Select Set up tunnel and follow the process output.
Coolify creates or reuses its server-specific tunnel, configures the hostname to forward to the server's SSH port, creates the DNS record, and installs the connector. Coolify then uses the SSH hostname for this server connection.
If the hostname already has a conflicting DNS record, Coolify shows the current value and asks whether to replace it. Review the hostname's existing use before confirming Replace DNS record.
Validate the connection and confirm the tunnel is healthy before restricting direct SSH access. If token validation or setup fails, check all three provider permissions, the accessible zones, and the server's initial SSH connection.
Disable a managed tunnel
Open the server's Cloudflare Tunnel page and select Disable Cloudflare Tunnel. Review the confirmation and enter the requested text.
Coolify removes the managed Cloudflare tunnel and the DNS record it created. It restores the previous server IP when saved; otherwise, restore the direct address yourself. Ensure direct SSH is reachable before disabling the tunnel so server management can continue.
Known issues and Solutions
When you create a new routes on Tunnel, Cloudflare will create a DNS record for the hostname.
However, if a DNS record for the hostname already exists, Cloudflare won’t update existing record.
In this case, your app won’t work. To fix this issue, follow the steps below:
- Click on your tunnel
- Click on Configure option
- Copy your tunnel ID from the Tunnels details section.
Create a new DNS record with the following details:
- In the Cloudflare dashboard, go to DNS.
- Select Records.
- Add a CNAME record.
- Enter the name as
*or the name of your subdomain (this should match the hostname you have for your app on the tunnel). - For the Target, enter the tunnel ID followed by
.cfargotunnel.com - Set the proxy status to Proxied.
Now, visit the domain of your application, and it should be accessible there.
Single resource
Securely access individual Coolify applications through Cloudflare Tunnels with port mapping, domain configuration, and multi-resource tunneling support.
Full TLS
Configure end-to-end HTTPS for Coolify resources through Cloudflare Tunnels with Origin Certificates, strict TLS encryption, and proper domain setup.