Name	Size	Mode	Actions
CLOUDFLARE_TUNNEL.md	4748	0644	editdlrm
nginx-site.conf	1049	0644	editdlrm
VPS_DEPLOYMENT.md	3676	0644	editdlrm

# Cloudflare Tunnel deployment guide Use this deployment mode when you do not want to expose ports `80` or `443` on the VPS, the VPS is behind NAT or a firewall, or you want outbound-only connectivity to Cloudflare. In this mode: - Docker runs the Trello Power-Up container privately. - `cloudflared` runs as a second container. - No host ports are published. - Cloudflare maps your public hostname to the private Docker service `http://trello-import-powerup:80`. - Trello uses `https://YOUR_SUBDOMAIN/index.html` as the iframe connector URL. ## Prerequisites - Your domain is managed in Cloudflare DNS. - Docker and Docker Compose are installed on the VPS. - You have a Trello Power-Up API key from Trello Power-Up Admin. - You have access to Cloudflare Zero Trust. ## 1. Create the Cloudflare Tunnel In Cloudflare: 1. Open **Zero Trust**. 2. Go to **Networks** → **Tunnels**. 3. Create a tunnel. 4. Choose **Cloudflared**. 5. Name it, for example `trello-import-powerup`. 6. Copy the tunnel token. Do not create a Cloudflare Access policy for this hostname. Trello must be able to load the Power-Up iframe directly. ## 2. Add the public hostname In the tunnel settings, add a public hostname: ```text Subdomain: trello-import Domain: example.com Path: leave empty Type: HTTP URL: trello-import-powerup:80 ``` The resulting public URL will be: ```text https://trello-import.example.com ``` Cloudflare will route that hostname through the tunnel to the Docker service. ## 3. Upload the project From your local machine: ```bash scp trello-import-powerup-cloudflare.zip root@YOUR_SERVER:/opt/ ssh root@YOUR_SERVER cd /opt unzip trello-import-powerup-cloudflare.zip cd trello-import-powerup ``` ## 4. Configure environment variables ```bash cp .env.example .env nano .env ``` Set: ```env TRELLO_APP_KEY=your_real_trello_powerup_api_key TRELLO_APP_NAME=Import JSON/CSV TRELLO_APP_AUTHOR=Your Name or Company TRELLO_APP_VERSION=1.0.0 CLOUDFLARE_TUNNEL_TOKEN=your_cloudflare_tunnel_token ``` Keep `CLOUDFLARE_TUNNEL_TOKEN` secret. Anyone with this token can run your tunnel. ## 5. Start the private app and tunnel ```bash docker compose -f docker-compose.cloudflare.yml up -d --build ``` Check container status: ```bash docker compose -f docker-compose.cloudflare.yml ps ``` Check the app health from inside the app container: ```bash docker compose -f docker-compose.cloudflare.yml exec trello-import-powerup wget -qO- http://localhost/healthz ``` Expected output: ```text ok ``` Check tunnel logs: ```bash docker compose -f docker-compose.cloudflare.yml logs -f cloudflared ``` You should see the tunnel connect to Cloudflare. ## 6. Test the public hostname From your local machine, not from inside the VPS: ```bash curl -I https://trello-import.example.com/index.html ``` Expected result: ```text HTTP/2 200 ``` Also open the URL in a browser: ```text https://trello-import.example.com/index.html ``` ## 7. Update Trello Power-Up Admin In Trello Power-Up Admin: 1. Set **Iframe connector URL** to: ```text https://trello-import.example.com/index.html ``` 2. Enable these capabilities: ```text board-buttons on-enable show-settings ``` 3. In the API Key tab, add this allowed origin: ```text https://trello-import.example.com ``` Do not include `/index.html` in the allowed origin. ## 8. Firewall recommendation Because Cloudflare Tunnel is outbound-only, you do not need inbound `80` or `443` rules on the VPS. Allow outbound HTTPS from the VPS: ```text TCP 443 outbound ``` You may keep inbound ports closed except for your own management method, such as SSH or a private VPN. ## Updating later ```bash cd /opt/trello-import-powerup docker compose -f docker-compose.cloudflare.yml up -d --build ``` ## Stopping the tunnel ```bash docker compose -f docker-compose.cloudflare.yml down ``` ## Troubleshooting ### Cloudflare shows 502 or 1033 Check that both containers are running: ```bash docker compose -f docker-compose.cloudflare.yml ps ``` Check tunnel logs: ```bash docker compose -f docker-compose.cloudflare.yml logs cloudflared ``` Confirm the public hostname service URL is exactly: ```text http://trello-import-powerup:80 ``` ### Trello says authorization failed Confirm the allowed origin in Trello Power-Up Admin is exactly: ```text https://trello-import.example.com ``` Do not include a path. ### Trello iframe does not load Do not enable Cloudflare Access, bot challenges, or a login requirement on this hostname. Trello must be able to load the iframe connector directly. ### Browser console shows frame blocking errors Do not add this header: ```text X-Frame-Options: SAMEORIGIN ``` Trello loads the connector in an iframe.