FM / deploy

/home/techb158/trello-import.abdallabala.com/deploy/

/home/techb158/trello-import.abdallabala.com/deploy

Name	Size	Mode	Actions
CLOUDFLARE_TUNNEL.md	4748	0644	edit dl rm
nginx-site.conf	1049	0644	edit dl rm
VPS_DEPLOYMENT.md	3676	0644	edit dl rm

Edit: /home/techb158/trello-import.abdallabala.com/deploy/CLOUDFLARE_TUNNEL.md (4748B)

# Cloudflare Tunnel deployment guide

Use this deployment mode when you do not want to expose ports `80` or `443` on the VPS, the VPS is behind NAT or a firewall, or you want outbound-only connectivity to Cloudflare.

In this mode:

- Docker runs the Trello Power-Up container privately.
- `cloudflared` runs as a second container.
- No host ports are published.
- Cloudflare maps your public hostname to the private Docker service `http://trello-import-powerup:80`.
- Trello uses `https://YOUR_SUBDOMAIN/index.html` as the iframe connector URL.

## Prerequisites

- Your domain is managed in Cloudflare DNS.
- Docker and Docker Compose are installed on the VPS.
- You have a Trello Power-Up API key from Trello Power-Up Admin.
- You have access to Cloudflare Zero Trust.

## 1. Create the Cloudflare Tunnel

In Cloudflare:

1. Open **Zero Trust**.
2. Go to **Networks** → **Tunnels**.
3. Create a tunnel.
4. Choose **Cloudflared**.
5. Name it, for example `trello-import-powerup`.
6. Copy the tunnel token.

Do not create a Cloudflare Access policy for this hostname. Trello must be able to load the Power-Up iframe directly.

## 2. Add the public hostname

In the tunnel settings, add a public hostname:

```text
Subdomain: trello-import
Domain: example.com
Path: leave empty
Type: HTTP
URL: trello-import-powerup:80
```

The resulting public URL will be:

```text
https://trello-import.example.com
```

Cloudflare will route that hostname through the tunnel to the Docker service.

## 3. Upload the project

From your local machine:

```bash
scp trello-import-powerup-cloudflare.zip root@YOUR_SERVER:/opt/
ssh root@YOUR_SERVER
cd /opt
unzip trello-import-powerup-cloudflare.zip
cd trello-import-powerup
```

## 4. Configure environment variables

```bash
cp .env.example .env
nano .env
```

Set:

```env
TRELLO_APP_KEY=your_real_trello_powerup_api_key
TRELLO_APP_NAME=Import JSON/CSV
TRELLO_APP_AUTHOR=Your Name or Company
TRELLO_APP_VERSION=1.0.0
CLOUDFLARE_TUNNEL_TOKEN=your_cloudflare_tunnel_token
```

Keep `CLOUDFLARE_TUNNEL_TOKEN` secret. Anyone with this token can run your tunnel.

## 5. Start the private app and tunnel

```bash
docker compose -f docker-compose.cloudflare.yml up -d --build
```

Check container status:

```bash
docker compose -f docker-compose.cloudflare.yml ps
```

Check the app health from inside the app container:

```bash
docker compose -f docker-compose.cloudflare.yml exec trello-import-powerup wget -qO- http://localhost/healthz
```

Expected output:

```text
ok
```

Check tunnel logs:

```bash
docker compose -f docker-compose.cloudflare.yml logs -f cloudflared
```

You should see the tunnel connect to Cloudflare.

## 6. Test the public hostname

From your local machine, not from inside the VPS:

```bash
curl -I https://trello-import.example.com/index.html
```

Expected result:

```text
HTTP/2 200
```

Also open the URL in a browser:

```text
https://trello-import.example.com/index.html
```

## 7. Update Trello Power-Up Admin

In Trello Power-Up Admin:

1. Set **Iframe connector URL** to:

```text
   https://trello-import.example.com/index.html
   ```

2. Enable these capabilities:

```text
   board-buttons
   on-enable
   show-settings
   ```

3. In the API Key tab, add this allowed origin:

```text
   https://trello-import.example.com
   ```

Do not include `/index.html` in the allowed origin.

## 8. Firewall recommendation

Because Cloudflare Tunnel is outbound-only, you do not need inbound `80` or `443` rules on the VPS.

Allow outbound HTTPS from the VPS:

```text
TCP 443 outbound
```

You may keep inbound ports closed except for your own management method, such as SSH or a private VPN.

## Updating later

```bash
cd /opt/trello-import-powerup
docker compose -f docker-compose.cloudflare.yml up -d --build
```

## Stopping the tunnel

```bash
docker compose -f docker-compose.cloudflare.yml down
```

## Troubleshooting

### Cloudflare shows 502 or 1033

Check that both containers are running:

```bash
docker compose -f docker-compose.cloudflare.yml ps
```

Check tunnel logs:

```bash
docker compose -f docker-compose.cloudflare.yml logs cloudflared
```

Confirm the public hostname service URL is exactly:

```text
http://trello-import-powerup:80
```

### Trello says authorization failed

Confirm the allowed origin in Trello Power-Up Admin is exactly:

```text
https://trello-import.example.com
```

Do not include a path.

### Trello iframe does not load

Do not enable Cloudflare Access, bot challenges, or a login requirement on this hostname. Trello must be able to load the iframe connector directly.

### Browser console shows frame blocking errors

Do not add this header:

```text
X-Frame-Options: SAMEORIGIN
```

Trello loads the connector in an iframe.

cmd: