Hosting Many Sites Behind One Cloudflare Tunnel

your-web-host serves a dozen hostnames — thelabsource.com, adi., books., git., music., wiki., plus other domains — through a single Cloudflare Tunnel (your-tunnel). No ports are opened on the router; cloudflared dials out and Cloudflare routes inbound traffic back through it.

#How routing works

The tunnel has an ingress list in /etc/cloudflared/config.yml. cloudflared matches each incoming request's hostname top-to-bottom and forwards it to the mapped local service. Most hostnames land on Apache at localhost:80, which then picks the right site by name-based vhost.

tunnel: YOUR_TUNNEL_ID
credentials-file: /home/youruser/.cloudflared/YOUR_TUNNEL_ID-...json
ingress:
  - hostname: thelabsource.com
    service: http://localhost:80
  - hostname: books.thelabsource.com
    service: http://localhost:80
  - hostname: ai.thelabsource.com
    service: http://localhost:3080      # a non-Apache app
  - hostname: notes.thelabsource.com
    service: http://localhost:8080
  - service: http_status:404            # catch-all — MUST be last

The catch-all 404 must be the final rule. Any hostname without an explicit rule above it falls through to the 404 — so adding a new site means adding its rule before that line.

#Adding a new hostname (what we did for this wiki)

1. Ingress rule — insert before the catch-all and restart:

   # add:
   #   - hostname: wiki.thelabsource.com
   #     service: http://localhost:80
   sudo cloudflared tunnel ingress validate
   sudo systemctl restart cloudflared

2. DNS — point the hostname at the tunnel with a proxied CNAME to <TUNNEL_UUID>.cfargotunnel.com. Easiest is to let cloudflared create it:

   cloudflared tunnel route dns your-tunnel wiki.thelabsource.com

3. Origin — make sure something answers at the mapped port (here, an Apache vhost for wiki.thelabsource.com).

#Gotchas

• Order matters — first matching hostname wins; the 404 stays last.
• Always ingress validate before restarting; a malformed rule takes down every site on the tunnel.
• Back up config.yml before editing.
• TLS terminates at Cloudflare. The origin can stay plain HTTP on localhost:80; let Cloudflare own certs and HTTPS.

See also: Tailscale Serve on 443 While Apache Stays on 80.