Cloudflare Zero Trust on Hostinger N8N

cloudflare-zero-trust-on-hostinger-n8n.md

0. Assumptions

• Hostinger N8N plan
• Cloudflare free account
• OS: Ubuntu 24.04 LTS
• Reverse proxy: Traefik (running in Docker)
• App (e.g. n8n) is running behind Traefik
• You want to protect https://<subdomain>.<domain> with Cloudflare Zero Trust via a Cloudflare Tunnel
• Your DNS for <domain> is managed by Cloudflare

---

1️⃣ Configure Traefik (HTTP → HTTPS, no ACME)

In your Traefik service (Docker Compose or similar), the command block should look like:

command:
  - --api=true
  - --api.insecure=true
  - --providers.docker=true
  - --providers.docker.exposedbydefault=false
  - --entrypoints.web.address=:80
  - --entrypoints.web.http.redirections.entryPoint.to=websecure
  - --entrypoints.web.http.redirections.entryPoint.scheme=https
  - --entrypoints.websecure.address=:443

Important:

• Do not configure ACME / Let’s Encrypt inside Traefik (no --certificatesresolvers.*.acme.* flags)
• Traefik terminates HTTPS internally on port 443
• HTTP on 80 just redirects to websecure (HTTPS)

Restart Traefik so this config is live.

---

2️⃣ Install cloudflared on Ubuntu 24.04 (noble)

Log into Hostinger. Click on terminal button in top right corner.

Run these commands on the server:

# Add Cloudflare GPG key
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

# Add Cloudflare repos (stable + next)
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared noble main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://next.pkg.cloudflare.com/cloudflared noble main' | sudo tee /etc/apt/sources.list.d/cloudflared.list

# Install cloudflared
sudo apt-get update && sudo apt-get install cloudflared

Verify:

cloudflared --version

---

3️⃣ Authenticate cloudflared with Cloudflare

cloudflared tunnel login

A browser window opens → choose your Cloudflare account and a domain → authorize.

---

4️⃣ Create the tunnel

Pick a tunnel name, e.g. my-tunnel:

cloudflared tunnel create my-tunnel

This prints:

• Tunnel ID (UUID), e.g. 11111111-2222-3333-4444-555555555555
• Path to the credentials JSON file (under ~/.cloudflared/)

---

5️⃣ Create /etc/cloudflared/config.yml

Create or edit the config:

sudo nano /etc/cloudflared/config.yml

Put this inside (replace with your actual Tunnel ID and JSON filename):

tunnel: 11111111-2222-3333-4444-555555555555
credentials-file: /root/.cloudflared/11111111-2222-3333-4444-555555555555.json

ingress:
  - hostname: <subdomain>.<domain>
    service: https://localhost:443
    originRequest:
      noTLSVerify: true
  - service: http_status:404

Key points:

• service: https://localhost:443 → the tunnel talks directly to Traefik’s HTTPS entrypoint (websecure)
• noTLSVerify: true → allows Traefik to use self-signed or internal certificates

Save, then restart the tunnel:

sudo systemctl restart cloudflared
sudo systemctl status cloudflared

You should see active (running).

---

6️⃣ Bind hostname → tunnel via DNS (automatic CNAME)

Let cloudflared create/update the DNS record for you:

cloudflared tunnel route dns my-tunnel <subdomain>.<domain>

• my-tunnel = tunnel name (from step 4)
• <subdomain>.<domain> = the hostname you want to protect

This command:

• Creates/updates a CNAME in Cloudflare DNS for <subdomain>.<domain>
• Associates that hostname with the my-tunnel Cloudflare Tunnel

No manual DNS edits are required.

---

7️⃣ Configure Cloudflare Zero Trust Access

In the Cloudflare dashboard:

1. Go to Zero Trust → Access → Applications

2. Click Add an application → Self-hosted

3. Configure:

   • Application name: (e.g. n8n)
   • Domain: <subdomain>.<domain>

4. Under Policies, create an access rule, for example:

   • Action: Allow
   • Include: Emails → [email protected] (or your org domain)

Save the application.

---

8️⃣ Sanity check on the server

Confirm Traefik is answering on HTTPS:

curl -I -k https://localhost:443

You should see HTTP headers (even a 302 or 404 is fine) — that means Traefik is reachable on 443.

---

9️⃣ Final test in the browser

Open an incognito/private browser window and go to:

https://<subdomain>.<domain>

Expected flow:

1. Cloudflare Zero Trust / Access login prompt
2. After successful login, traffic is sent over the Cloudflare Tunnel
3. The tunnel forwards HTTPS to https://localhost:443 (Traefik)
4. Traefik routes the request to your app (e.g. n8n)
5. Your app UI loads, protected by Cloudflare Zero Trust.