A permanent address with Cloudflare Tunnel

Time

15 minutes, plus a few minutes for a new domain to settle.

You need

• The runner from Any Linux box
• A free Cloudflare account
• A domain you own, added to that account (or one bought in Cloudflare under Domain Registration → Register Domains, which adds it for you)

Set this up with your agent

Copy this to a coding agent on your laptop. It runs the commands and checks each step with you; what you sign in to, press or paste stays yours.

This is for a coding agent that can run commands on my laptop (Claude Code, Codex, Cursor), not a chat website.
Walk me through Loopgate's docs page "A permanent address with Cloudflare Tunnel": https://loopgate.dev/docs/address-cloudflare.md. The pages it links to are beside it, each ending in .md.
Run its commands yourself, on my laptop or on my box over SSH as the page says, one step at a time, and check each "You should see" line before the next step.
These are mine: tell me when it is my turn, wait for me, and never ask me to type them into this chat. Signing in to anything (the portal, a cloud console, Slack, GitHub), pressing Add a runner, every token and password, my AI subscription's device code, and making the Slack app.
If I paste you the portal's install line, run it on the box: its token works once, for an hour.

Steps

Make the tunnel

1. In the Cloudflare dashboard, open Zero Trust from the left menu. The first time, choose a team name and the Free plan. Cloudflare may ask for a card even for the free plan.

2. Go to Networks → Tunnels and press Create a tunnel.

3. Choose Cloudflared, name it loopgate-runner and save.

4. Choose Docker and copy only the token. Cloudflare shows a command that ends with --token and a long string starting eyJ. Copy that string. Do not run the command; Loopgate's file runs the connector for you.

Start the connector on your box

1. Go to the loopgate folder and download the tunnel's settings file.

   Copy

   cd ~/loopgate && curl -fsSLO https://loopgate.dev/runner/tunnel.env.example && cp tunnel.env.example tunnel.env

2. Paste the token after TUNNEL_TOKEN=, then save and leave (Ctrl+O, Enter, Ctrl+X). The token connects anything to your tunnel. Treat it like a password.

   Copy

   nano tunnel.env

3. Start the tunnel, now and on every start from now on.

   Copy

   echo "COMPOSE_PROFILES=tunnel" >> .env && docker compose up -d

   You should see: Container loopgate-runner-tunnel-1 Started, and in Cloudflare the tunnel's status turns Healthy within a minute.

Point a name at the runner

1. In Cloudflare, press Next (or open the tunnel's Public Hostname tab, called Published application routes in some accounts) and add one, leaving the other settings as they are:

   • Subdomain: runner
   • Domain: your domain
   • Service type: HTTP
   • URL: runner:4311

2. Give the runner its new address, with no slash at the end.

   Copy

   echo "LOOPGATE_RUNNER_URL=https://runner.yourcompany.com" >> runner.env

3. Restart the runner.

   Copy

   docker compose up -d runner

   You should see: the portal's Devices row shows the new address, no longer marked temporary.

4. Check the runner's own line.

   Copy

   docker compose logs runner

   You should see: Runner ready at https://runner.yourcompany.com.

5. In the Loopgate portal, open Devices and press Open on the runner's row.

   You should see: the workbench, on your new address. Settings → General names it permanent.

Good to know

• Your box dials out to Cloudflare and Cloudflare sends your team down that line, so the box opens no door to the internet.
• The runner's own door turns away anyone who is not a current member of your org, which is why a public address is safe.
• A browser stays signed in there for thirty days from its last use. A teammate on a link with no sign-in gets Sign in, which goes through the portal.
• Links Slack posts from now on survive a restart.
• By hand has every line of runner.env and tunnel.env.

If something is off

• "Not a current member of this org." An owner or admin adds the person in the portal. They can get in within about two minutes, and someone removed is out as fast.
• The tunnel is not Healthy. Check the token in tunnel.env, then run docker compose up -d.

Next

• Connect Slack
• Updates and backups