A Cloudflare Tunnel Connector That Keeps Its Token Off The Command Line

cloudflared-tunnel

cloudflared as a Cloudflare Tunnel connector: installed from Cloudflare's signed repository at a pinned version, run as a hardened systemd unit that reads its token from a root-only file. Original role for EL 10, live-tested with podman on Rocky Linux 10.

The token is a credential; keep it off the command line. The one-liner in the dashboard is cloudflared service install <token>. This role writes the token to /etc/cloudflared/token (root, 0600) and runs tunnel run --token-file from a unit of its own, so the token is not in a unit file, not in ps, not in the journal. The live test greps every process command line and the unit file for it and expects nothing.

Signed, and verifiably so on EL 10. Cloudflare's 2025 packaging key (CC94 B39C 77AE 7342 A68B 8962 8A68 2D30 8D4E 5E73) has no SHA-1 signatures, so rpm on EL 10 imports it and checks every package - unlike the AWS and Google keys, which it refuses. The role imports it by fingerprint and the live test asserts it is in rpm's keyring.

Pinned, and never self-updating. --no-autoupdate keeps the connector from replacing its own binary; a newer version is a variable change and a run through the package manager.

Without a real token it tries, and keeps trying. The placeholder token has the right shape and no valid secret, so the edge refuses it, the connector exits and systemd restarts it - which is what the live test sees, and reads from the journal. Give it the token from Zero Trust > Networks > Tunnels and the same unit connects. Set cloudflared_tunnel_refuse_placeholder_token: true in any real inventory.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.