docs: add Cloudflare Tunnel guidance for self-hosting#87
Conversation
📝 WalkthroughWalkthroughThis PR adds an optional Cloudflare Tunnel configuration section to the self-hosting documentation. The new content guides users through configuring tunnel credentials via environment variables, updating Docker Compose settings, deploying the cloudflared service, and routing public traffic to the internal web application while managing security considerations. ChangesCloudflare Tunnel Configuration Guide
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds documentation for optionally exposing a self-hosted Sure instance using a Cloudflare Tunnel. The review feedback suggests improving the documentation by providing more context for the RAILS_ASSUME_SSL environment variable in compose.yml, pinning a specific stable version for the cloudflared image instead of using latest, and explicitly advising users to remove the published ports from the web service to enhance security.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| 3. Edit `compose.yml` and set: | ||
|
|
||
| ```yaml | ||
| RAILS_ASSUME_SSL: "true" | ||
| ``` |
There was a problem hiding this comment.
To make it clearer for users where to add this environment variable in their compose.yml, it is recommended to show the context of the web service environment block.\n\nFor example:\nyaml\nservices:\n web:\n environment:\n RAILS_ASSUME_SSL: "true"\n
| cloudflared: | ||
| image: cloudflare/cloudflared:latest |
There was a problem hiding this comment.
Using the latest tag for the cloudflared image is discouraged for production/self-hosting environments as it can introduce unexpected breaking changes when the image is updated. It is highly recommended to pin a specific, stable version of the image.\n\nFor example:\nyaml\n image: cloudflare/cloudflared:2024.12.2\n
| <Warning> | ||
| If you only want Cloudflare Tunnel access, do not leave port `3000` broadly exposed to the internet. Keep the host firewall closed or bind the published port more narrowly. | ||
| </Warning> |
There was a problem hiding this comment.
When using a Cloudflare Tunnel, you can completely remove the ports section (e.g., - "3000:3000") from the web service in compose.yml. Since the cloudflared container and the web container share the same Docker network (sure_net), they can communicate internally. Removing the published ports ensures that the application is not exposed directly on the host, which is the primary security benefit of using a tunnel.\n\nConsider updating the warning to explicitly suggest removing the ports mapping from the web service.
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@self-hosting.mdx`:
- Around line 126-132: The instruction is ambiguous about where to add
RAILS_ASSUME_SSL in compose.yml; update the docs to instruct users to add
RAILS_ASSUME_SSL: "true" inside the existing x-rails-env: &rails_env section
(the shared rails environment anchor) so the variable is applied to the Rails
service definitions that extend &rails_env; mention the anchor name x-rails-env:
&rails_env and the RAILS_ASSUME_SSL key so maintainers can find and place the
setting correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| 3. Edit `compose.yml` and set: | ||
|
|
||
| ```yaml | ||
| RAILS_ASSUME_SSL: "true" | ||
| ``` | ||
|
|
||
| This tells Sure to generate HTTPS URLs correctly when Cloudflare terminates TLS before forwarding traffic to the container over HTTP. |
There was a problem hiding this comment.
Clarify where in compose.yml to set RAILS_ASSUME_SSL.
The instruction "Edit compose.yml and set:" doesn't specify the location within the file. Based on the troubleshooting guide, this should be set in the x-rails-env: &rails_env section. Users unfamiliar with the compose file structure may not know where to place this configuration.
📝 Suggested improvement
-3. Edit `compose.yml` and set:
+3. Edit `compose.yml` in the `x-rails-env: &rails_env` section and set:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@self-hosting.mdx` around lines 126 - 132, The instruction is ambiguous about
where to add RAILS_ASSUME_SSL in compose.yml; update the docs to instruct users
to add RAILS_ASSUME_SSL: "true" inside the existing x-rails-env: &rails_env
section (the shared rails environment anchor) so the variable is applied to the
Rails service definitions that extend &rails_env; mention the anchor name
x-rails-env: &rails_env and the RAILS_ASSUME_SSL key so maintainers can find and
place the setting correctly.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
1 participant
Summary
RAILS_ASSUME_SSLsetting behind TLS terminationcloudflaredservice and thehttp://web:3000origin settingWhy
People self-hosting Sure commonly want remote access without opening router ports, and Cloudflare Tunnel is a practical path for that setup.
Summary by CodeRabbit