Repository navigation
fix(cloudflared): stop logging the tunnel token - #3152
Merged
Merged
Conversation
Switch from wisdomsky/cloudflared-web to the official cloudflare/cloudflared image. The web UI wrapper printed the full command line, tunnel token included, to the container logs. The token now comes from TUNNEL_TOKEN in secrets.sops.env, which cloudflared does not log. This drops the web UI, its Traefik router and the homepage link. The homepage widget stays: it only uses the Cloudflare API. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🛡️ Trivy image scan — fixable HIGH/CRITICAL vulnerabilities foundThe images below have known vulnerabilities with fixes available. Update to a patched image (digest) before merging.
|
| CVE | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-63209 | github.com/klauspost/compress | v1.18.0 | 1.18.7 | HIGH |
MichielMak
enabled auto-merge (squash)
October 25, 2026 22:38
MichielMak
approved these changes
Oct 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
wisdomsky/cloudflared-webimage logs its full cloudflared command line at startup, tunnel token included. Anyone who can read container logs (Komodo, Docker tools, log shippers) could see it.What changed
cloudflare/cloudflared:2026.10.3, pinned by digest.tunnel --no-autoupdate runand reads the token from theTUNNEL_TOKENenvironment variable. cloudflared does not print that value.TUNNEL_TOKENcomes fromcloudflared/secrets.sops.envthrough the existing sops wrapper instacks.toml./configvolume and the homepage link. The homepage cloudflared widget stays, it only uses the Cloudflare API.cloudflare/OpenTofu), so no local config is needed.Manual steps (before or right after merging)
sops cloudflared/secrets.sops.env, add aTUNNEL_TOKEN=line with the current tunnel token, commit. Without this the tunnel will not start. The file doesn't have this key yet; the token was stored in the web UI's/config.compose.yamlchanged. Check in Komodo that it deployed and that the logs showRegistered tunnel connection. If it didn't redeploy, deploy the stack by hand.sops cloudflared/secrets.sops.env), commit, then deploy thecloudflaredstack by hand (a secrets-only change does not trigger Gitops).${DOCKER_DATA_DIR}/cloudflared/config(it holds the old token).Remaining risk: Plex tokens
cloudflared also logged failed requests with their full URL, and Plex puts
X-Plex-Tokenin the query string. These lines are logged at error level, so lowering the log level doesn't hide them without hiding real errors too. This PR doesn't fix that.The Plex token was already in the logs. Rotating it means Plex → Settings → Devices → "Sign out of all devices", which logs out every client. That's your call.
🤖 Generated with Claude Code