Cloudflare Tunnel (deprecated)

Deprecated

Publishing integration targets through Cloudflare Tunnel is deprecated and no longer recommended by wawa.

• New integrations: use a Site-to-Site VPN, or publish the target yourself using customer-managed public connectivity.
• Existing Cloudflare Tunnel setups keep working, but they are customer-managed public deployments. The clinic is responsible for hosting, securing and maintaining them, and wawa does not support them. Plan a move to one of the models above.

Migrating

1. Choose a model: Site-to-Site VPN, or public connectivity on a public IP you assign.
2. Give us the new target details (private IP and port, or public URL) and, if needed, your internal root CA certificate.
3. We update the integration's server in wawa and run Test Connection with you.
4. Once traffic flows on the new path, remove the tunnel and its DNS record.

Reference for existing setups

Previous Cloudflare Tunnel instructions (unsupported, kept for reference)

1. Add a domain to Cloudflare and create IP Access Rules (or a WAF rule) that block every source except wawa's egress IPs for your region. Ensure Bot Fight Mode and managed challenges don't apply to them.
2. Install cloudflared (cloudflared-linux-amd64.deb on Debian/Ubuntu, winget install Cloudflare.cloudflared on Windows), then run cloudflared tunnel login and cloudflared tunnel create <name>.
3. Configure /etc/cloudflared/config.yml with the tunnel ID, its credentials file, and an ingress rule mapping your hostname to the local service (for example http://127.0.0.1:8042), followed by a catch-all http_status:404.
4. Run cloudflared tunnel route dns <name> <hostname>, then install and enable cloudflared as a service.

See Cloudflare's Tunnel documentation for current details.