系统级安装验证

xcode-select --install
brew install cloudflare/cloudflare/cloudflared

shasum -a 256 $(which cloudflared) | grep 3d9d9a...  # 替换为官方校验码

• 执行后浏览器自动打开 Cloudflare 仪表盘
• 选择目标域名（如 example.com）
• 认证完成后生成 cert.pem 文件于 ~/.cloudflared/

隧道生命周期管理

cloudflared tunnel create macmini-tunnel

Tunnel credentials written to /Users/xxx/.cloudflared/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json
Tunnel UUID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

nano ~/.cloudflared/config.yml

tunnel: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
credentials-file: /Users/xxx/.cloudflared/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json
ingress:
- hostname: ssh.example.com
service: ssh://localhost:22
originRequest:
connectTimeout: 30s
tlsTimeout: 10s
- hostname: web.example.com
service: http://localhost:8080
originRequest:
httpHostHeader: web.example.com
disableChunkedEncoding: true
- service: http_status:404

DNS 记录优化策略

cloudflared tunnel route dns macmini-tunnel ssh.example.com

cloudflared tunnel route dns macmini-tunnel "*.apps.example.com"

ingress:
- hostname: "{{sub}}.apps.example.com"
service: http://localhost:{{sub_port}}

服务守护进程配置

sudo cloudflared service install --legacy

/Library/LaunchDaemons/com.cloudflare.cloudflared.plist

tail -f /Library/Logs/com.cloudflare.cloudflared.err.log

log show --predicate 'process == "cloudflared"' --info --debug --last 1h

安全增强措施

cloudflared access policy create \
--name dev-team \
--applications ssh.example.com \
--decision allow \
--include any(emails.split('@')[1] == 'company.com')

ingress:
- hostname: db.example.com
service: postgres://localhost:5432
originRequest:
mTLS:
cert: /path/to/client.crt
key: /path/to/client.key

性能调优参数

ingress:
- service: ssh://localhost:22
originRequest:
http2Origin: false
http3: true

cloudflared tunnel --region hkg run macmini-tunnel

验证与排错

cloudflared tunnel info macmini-tunnel

cloudflared tunnel test-http-override ssh.example.com

mtr --tcp --port 7844 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.cfargotunnel.com

1. 执行 cloudflared tunnel list 确认隧道状态为 ACTIVE
2. 查看系统服务状态：sudo launchctl list | grep cloudflare
3. 通过 dig +short ssh.example.com 验证 DNS 解析是否指向 .cfargotunnel.com