go-shortner-docs
Deployment

Cloudflare Tunnel

Expose GO Shortener securely through go.arcn.online without opening public firewall ports.

Cloudflare Tunnel

Cloudflare Tunnel (cloudflared) is the recommended method for exposing GO Shortener to the public internet at https://go.arcn.online.

Why Cloudflare Tunnel?

  1. Zero Open Ports: The tunnel establishes an outbound-only connection from your VPS to Cloudflare edge nodes. You do not need to open port 80 or 443 on your firewall.
  2. Origin IP Masked: Direct Denial of Service (DDoS) attacks cannot target your VPS directly because your origin IP is never revealed.
  3. Automatic SSL/TLS: Cloudflare handles SSL certificate generation, renewal, and HTTPS redirects at the edge.

Step-by-Step Setup

1. Install cloudflared on Your VPS

Download and install the official Cloudflare package for Ubuntu/Debian:

Terminal
# Download Debian package
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb

# Install package
sudo dpkg -i cloudflared.deb

2. Authenticate cloudflared

Authenticate your VPS with your Cloudflare account:

Terminal
cloudflared tunnel login

The CLI will print a login URL. Open this URL in your web browser, select your domain (arcn.online), and authorize the connection. An origin certificate will be written to /root/.cloudflared/cert.pem.

3. Create the Tunnel

Create a dedicated tunnel for your GO instance:

Terminal
cloudflared tunnel create go-tunnel

Cloudflare will generate a unique Tunnel UUID and save a credentials JSON file (e.g., /root/.cloudflared/<TUNNEL_ID>.json).

4. Route Your DNS Hostname

Point go.arcn.online to your tunnel:

Terminal
cloudflared tunnel route dns go-tunnel go.arcn.online

This creates a CNAME record in your Cloudflare DNS zone pointing to <TUNNEL_ID>.cfargotunnel.com.

5. Create Tunnel Configuration File

Create /root/.cloudflared/config.yml:

/root/.cloudflared/config.yml
tunnel: <TUNNEL_ID>
credentials-file: /root/.cloudflared/<TUNNEL_ID>.json

ingress:
  - hostname: go.arcn.online
    service: http://127.0.0.1:3000
  - service: http_status:404
Replace <TUNNEL_ID> with your actual Tunnel UUID from Step 3.

6. Install as a System Service & Start

Install cloudflared as a native systemd service so it starts on system boot:

Terminal
cloudflared service install
systemctl enable --now cloudflared

Verifying the Tunnel

  1. Check the tunnel service status:
    Terminal
    systemctl status cloudflared
  2. Open your browser and navigate to https://go.arcn.online.
  3. You should see the GO Shortener homepage with a secure SSL lock icon.

Environment Variables

Comprehensive production environment variables and security hardening guidelines.

Systemd

Manage the GO Shortener background service, auto-restarts, and logs using systemd.

Copyright © 2026