Skip to content

public-hosting.md

Latest commit

 

History

History
70 lines (51 loc) · 2.78 KB

public-hosting.md

File metadata and controls

70 lines (51 loc) · 2.78 KB
Raw

Accessing your instance from anywhere

InboxSwipe has no built-in authentication. Never expose it directly to the internet — anyone who finds it can read your email metadata and swipe your mailbox. Always put an identity gate in front of it.

Recommended: Cloudflare Tunnel + Access (free)

Requires a domain on Cloudflare DNS.

  1. Create a tunnel — one.dash.cloudflare.com → Networks → Tunnels → Create a tunnel → Cloudflared. Copy the token (long string starting eyJ).

  2. Route your hostname — in the tunnel's Public Hostname tab, add:

    • Subdomain/domain: e.g. swipe.yourdomain.com
    • Service type: HTTP
    • URL: inboxswipe:3000

    Plain HTTP is correct here — this hop is container-to-container inside your Docker network. Cloudflare terminates public HTTPS for you, and inboxswipe resolves via Docker's DNS because cloudflared runs in the same compose stack.

    1. Run the connector — add to .env: TUNNEL_TOKEN=eyJ...

    Then:

      docker compose -f docker-compose.yml -f docker-compose.cloudflare.yml up -d

    Check the tunnel shows HEALTHY in the Cloudflare dashboard.

  3. Gate it with Access — before visiting the URL: Zero Trust → Access → Applications → Add an application → Self-hosted and private → Public DNS tab.

    • Hostname: same as step 2
    • Session duration: 1 month
    • Policy: Allow → include → Emails → your email only
    • Login method: One-time PIN (default) is fine

  4. Update OAuth for the new origin:

    • Google Console → Credentials → your OAuth client → add redirect URI: https://swipe.yourdomain.com/oauth/callback
    • In .env: BASE_URL=https://swipe.yourdomain.com
    • Rebuild: docker compose -f docker-compose.yml -f docker-compose.cloudflare.yml up -d --build

    Connecting and reconnecting Gmail now works from any device — the localhost/SSH-tunnel trick is no longer needed.

Troubleshooting

Symptom Cause
Error 1033 Tunnel not connected — check docker compose logs cloudflared
Access redirect loop Hostname mismatch between Access app and tunnel route
Reconnect fails after setup Redirect URI in Google Console doesn't exactly match ${BASE_URL}/oauth/callback

Privacy note

Cloudflare terminates TLS at their edge, so they can technically inspect traffic. If that bothers you, use Tailscale instead:

Alternative: Tailscale

Install Tailscale on your server, then tailscale serve 3000 gives you an HTTPS hostname reachable only from your own devices — identity is implicit (only your tailnet can connect) and no third party proxies your traffic. Register the tailnet hostname as a redirect URI and set BASE_URL to match.