├── .github └── workflows │ └── ci.yml ├── Dockerfile ├── LICENSE └── README.md /.github/workflows/ci.yml: -------------------------------------------------------------------------------- 1 | name: Build and Push 2 | 3 | on: 4 | push: 5 | branches: 6 | - master 7 | workflow_dispatch: 8 | 9 | jobs: 10 | docker: 11 | runs-on: ubuntu-latest 12 | if: "!contains(github.event.head_commit.message, '[skip ci]')" 13 | steps: 14 | - name: Checkout 15 | uses: actions/checkout@v2 16 | 17 | - name: Set up QEMU 18 | uses: docker/setup-qemu-action@master 19 | with: 20 | platforms: all 21 | 22 | - name: Set up Docker Buildx 23 | id: buildx 24 | uses: docker/setup-buildx-action@master 25 | 26 | - name: Cache Docker layers 27 | uses: actions/cache@v2 28 | with: 29 | path: /tmp/.buildx-cache 30 | key: ${{ runner.os }}-buildx-${{ github.sha }} 31 | restore-keys: | 32 | ${{ runner.os }}-buildx- 33 | 34 | - name: Login to Docker Hub 35 | if: github.event_name != 'pull_request' 36 | uses: docker/login-action@v1 37 | with: 38 | username: jakejarvis 39 | password: ${{ secrets.DOCKER_HUB_TOKEN }} 40 | 41 | - name: Login to GitHub Container Registry 42 | if: github.event_name != 'pull_request' 43 | uses: docker/login-action@v1 44 | with: 45 | registry: ghcr.io 46 | username: ${{ github.repository_owner }} 47 | password: ${{ secrets.GHCR_PAT }} 48 | 49 | - name: Build and Push 50 | id: build 51 | uses: docker/build-push-action@v2 52 | with: 53 | builder: ${{ steps.buildx.outputs.name }} 54 | tags: jakejarvis/cloudflare-argo:latest,ghcr.io/jakejarvis/cloudflare-argo:latest 55 | platforms: linux/amd64,linux/arm64 56 | file: ./Dockerfile 57 | context: ./ 58 | push: true 59 | cache-from: type=local,src=/tmp/.buildx-cache 60 | cache-to: type=local,dest=/tmp/.buildx-cache 61 | 62 | - name: Image digest 63 | run: echo ${{ steps.build.outputs.digest }} 64 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM docker.io/ubuntu:focal 2 | 3 | LABEL maintainer="Jake Jarvis " 4 | LABEL repository="https://github.com/jakejarvis/docker-cloudflare-argo" 5 | 6 | # https://docs.github.com/en/free-pro-team@latest/packages/managing-container-images-with-github-container-registry/connecting-a-repository-to-a-container-image#connecting-a-repository-to-a-container-image-on-the-command-line 7 | LABEL org.opencontainers.image.source="https://github.com/jakejarvis/docker-cloudflare-argo" 8 | 9 | ARG CLOUDFLARED_VERSION 10 | ARG DEBIAN_FRONTEND=noninteractive 11 | 12 | RUN apt-get update && \ 13 | apt-get install -y --no-install-recommends wget ca-certificates && \ 14 | rm -rf /var/lib/apt/lists/* 15 | 16 | RUN ARCH="" && \ 17 | case $(uname -m) in \ 18 | x86_64) ARCH="amd64" ;; \ 19 | aarch64) ARCH="arm64" ;; \ 20 | *) echo "Unknown build architecture $(uname -m), quitting."; exit 2 ;; \ 21 | esac && \ 22 | wget -q https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION:-../latest/download}/cloudflared-linux-${ARCH}.deb && \ 23 | dpkg -i cloudflared-linux-${ARCH}.deb && \ 24 | rm cloudflared-linux-${ARCH}.deb && \ 25 | cloudflared --version 26 | 27 | ENTRYPOINT ["cloudflared", "tunnel"] 28 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2019 Jake Jarvis https://jarv.is 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # docker-cloudflare-argo 2 | 3 | [![CI](https://github.com/jakejarvis/docker-cloudflare-argo/actions/workflows/ci.yml/badge.svg)](https://github.com/jakejarvis/docker-cloudflare-argo/actions/workflows/ci.yml) 4 | ![Docker Pulls](https://img.shields.io/docker/pulls/jakejarvis/cloudflare-argo.svg) 5 | 6 | A Docker image designed to be an intermediary between your local containers (or anything on your local network) and [Cloudflare's Argo tunneling service](https://www.cloudflare.com/products/argo-tunnel/). 7 | 8 | (AKA: A fantastic way to avoid exposing your containers **and** your host to the scary, scary world.) 9 | 10 | ## Prerequisites 11 | 12 | Registration for Argo is done through the [Cloudflare dashboard](https://dash.cloudflare.com/) (it currently costs $5/month). 13 | 14 | And, for now, a certificate file (`.pem`) [needs to be obtained via `cloudflared tunnel login`](https://developers.cloudflare.com/argo-tunnel/quickstart/#step-3-login-to-your-cloudflare-account) *before* using the container. This can be done on any computer. 15 | 16 | ## Configuration 17 | 18 | The following environment variables are required: 19 | 20 | - `TUNNEL_HOSTNAME`: The hostname/subdomain of the public-facing zone registered with Cloudflare 21 | - `TUNNEL_URL`: The backend URL server you want to dig the tunnel to, probably on your local/Docker network 22 | 23 | ...and your `.pem` file (the login certificate from Cloudflare) needs to be mounted to `/etc/cloudflared/cert.pem` on the Argo container, as shown in the example. 24 | 25 | ## Usage 26 | 27 | ```bash 28 | docker run -d \ 29 | -e "TUNNEL_HOSTNAME=mytunnel.jarv.is" \ 30 | -e "TUNNEL_URL=http://localhost:8080" \ 31 | -v "/Users/jake/config/cert.pem:/etc/cloudflared/cert.pem" \ 32 | jakejarvis/cloudflare-argo:latest 33 | ``` 34 | 35 | If building locally, a [`cloudflared` version](https://github.com/cloudflare/cloudflared/releases) can be specified as a build-time argument (e.g. `2021.10.11`; defaults to `latest`): 36 | 37 | ```bash 38 | docker build --build-arg CLOUDFLARED_VERSION=2021.10.5 . 39 | ``` 40 | 41 | ## License 42 | 43 | MIT 44 | --------------------------------------------------------------------------------