Cloudflare argo tunnel configuration #23

jorgeal94 · 2024-03-11T20:38:55Z

jorgeal94
Mar 11, 2024

Hi, moving from issues, I'm trying to configure the http proxy with argo tunnel but I cant do it, info:

NGINX CONFIG:
domain: homeassistant.example.es
hsts: max-age=31536000; includeSubDomains
certfile: fullchain.pem
keyfile: privkey.pem
cloudflare: true
customize:
active: false
default: nginx_proxy_default*.conf
servers: nginx_proxy/*.conf

Cloudflared config:
external_hostname: homeassistant.example.es
additional_hosts: []
nginx_proxy_manager: false
tunnel_token: >-xxxxxxxxxxxxxxxxxxxxx
tunnel_name: Homeassistant

Config.yaml:

http:
use_x_forwarded_for: true
trusted_proxies:
- 172.30.33.0/24
- 127.0.0.1
- 10.0.0.2
#cloudflare ipv4
- 103.21.244.0/22
- 103.22.200.0/22
- 103.31.4.0/22
- 104.16.0.0/13
- 104.24.0.0/14
- 108.162.192.0/18
- 131.0.72.0/22
- 141.101.64.0/18
- 162.158.0.0/15
- 172.64.0.0/13
- 173.245.48.0/20
- 188.114.96.0/20
- 190.93.240.0/20
- 197.234.240.0/22
- 198.41.128.0/17
#cloudflare ipv6
- 2400:cb00::/32
- 2606:4700::/32
- 2803:f800::/32
- 2405:b500::/32
- 2405:8100::/32
- 2a06:98c0::/29
- 2c0f:f248::/32

On cloudflare web - Zero trust- I configure:
Public hostname -> homeassistant.example.es
Service -> http;//192.168.0.2:8123

On Dns Zone:
CNAME tesla.example.es -> https://homeassistant.example.es

Something wrong? Thanks for replying

baylanger · 2024-03-11T21:28:10Z

baylanger
Mar 11, 2024

[EDIT] IF you use HA Cloudflare add-on skip this comment, I posted a solution down below that might work. Waiting for feedback from someone to give it a try.

For the trusted_proxies in configuration.yaml, you only need 172.30.33.0/24. The reason is that Nginx is taking the traffic from Cloudflare that is proxied to the http port of HA. That's why there is "cloudflare: true" in the Nginx add-on config.

trusted_proxies:
  - 172.30.33.0/24

All of the remaining IPs can be removed.

cloudflare tunnel, per the config you posted above I am guessing you are using the Cloudflare HAOS add-on. I don't run this add-on, I run cloudflared in a docker container that I configured manually. For the add-on, I don't know if it can support both "homeassistant.example.es" & "tesla.example.es". Perhaps you can look in the doc or request help from them.

In case the add-on can't help you, here's my docker-compose.yaml file , some commands I used and example config.

version: '3.9'
services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    volumes:
      - "/volume1/docker/cloudflared-tesla/etc/cloudflared:/etc/cloudflared"
      - "/etc/localtime:/etc/localtime:ro"
    command: "tunnel --config /etc/cloudflared/config.yml --protocol http2 run tesla-callback"
    environment:
      TZ: "Canada/Eastern"
    restart: unless-stopped

Note: --protocol http2 is defined otherwise the Tunnel would not come up. After searching, the error suggested there's a bug with the app or service. It's possible this bug is now fixed. The default is auto, options are auto, http2, and quic.

Directory structure:

./etc
./etc/cloudflared
./etc/cloudflared/config.yml
./etc/cloudflared/cert.pem
./etc/cloudflared/23fef8df-xxxxxxxxxxxxx.json
./get-cert
./get-tunnel-config
./docker-compose.yaml

# get-cert
docker run --rm -it -v "/volume1/docker/cloudflared-tesla/etc/cloudflared:/home/nonroot/.cloudflared" cloudflare/cloudflared:latest tunnel login

^^ Follow on screen instructions to add the tunnel to your account.

# get-tunnel-config
mkdir -p /volume1/docker/cloudflared-tesla/etc/cloudflared
chmod 777 /volume1/docker/cloudflared-tesla/etc/cloudflared
docker run --rm -it -v "/volume1/docker/cloudflared-tesla/etc/cloudflared:/home/nonroot/.cloudflared" cloudflare/cloudflared:latest tunnel create tesla-callback

Note: chmod 777 cuz I'm lazy, you can change it back to 755 once the config is complete.

$ cat etc/cloudflared/config.yml
url: https://homeassistant.example.escom/
tunnel: 23fef8df-xxxxxxx
credentials-file: /etc/cloudflared/23fef8df-xxxxxx.json

I never tried it myself but it's probably permitted to create in Cloudflare DNS 2 CNAME "homeassistant.example.es" and "tesla.example.es" that points to the same argo tunnel... per your config, the add-on uses "external_hostname: homeassistant.example.es" , you probably need to set "additional_hosts: tesla.example.es".

Not sure I was quite helpful but hoping the guidance above helps.

[edit] added reference to "additional_hosts: tesla.example.es"

0 replies

baylanger · 2024-03-12T19:59:50Z

baylanger
Mar 12, 2024

I just noticed your config for Cloudflare add-on shows:

Cloudflared config:
external_hostname: homeassistant.example.es
additional_hosts: []

My guess ... maybe all you need is to add additional_hosts: tesla.example.es - regardless if that fixes everything or not you probably need that as well.

The SSL cert must support both {homeassistant,tesla}.example.es - depending on your case, if you have your own domain use a wildcard cert otherwise use a multi domain SAN cert.

58 replies

alexeiw123 Apr 1, 2024

OK, I finally took a few hours to unpack why this hasn't been working at my end. I made some discoveries that might help people..

First of all, @Black2vs2's guide on the wiki was helpful. I had got to this point myself by crawling through many posts but to have it all in once place was very helpful. Also, my domain is not purchased through cloudflare but this still worked without having to move my domain (which I was worried I might have to do)

Issue 1:
NGINX HA add-on doesn't seem to 'take' the customize settings if it has been run prior to those .conf files being created by the tesla proxy add-on. I simply had to copy the configuration .yaml, uninstall the add-on, reinstall, paste config and start. You can see in the logs if it's doing anything meaningful

customize:
  active: true

Issue 2:
Unbound DNS (through OPNSense) used DNS Rebind Check - which stops these domains from being accessible. I was able to disable this security feature to figure this out and configure, but I was not comfortable with that security risk given I don't fully understand it.
Within the Unbound DNS Advanced Settings there is an option for Private Domains. In here, I entered the domains which I'm calling on: tesla.example.com and homeassistant-internal.example.com. I'm able to now access the key and also can see that the cloudflared tunnel logs don't return errors.

Issue 3:
Once all the config was done, I still wasn't able to auth my car - this is because I had taken the extra security step of creating a separate tesla account for my API access, which is shared form my main. If you've done this, you need to log in to the API access tesla account froma phone, create a key in your car and use that to authorise the car.

This sure has been a mission but my HA app is finally working again.

Now, I need to figure out how to point my teslamate instance to this.

llamafilm Apr 1, 2024
Maintainer

@alexeiw123 I've never had to uninstall Nginx addon; it should pick up the new config after a restart.
Your other issues and solutions make sense to me.

alexeiw123 Apr 1, 2024

I suspect that is something relatively unique to my setup on a HA yellow. I've noticed it with other add-ons before and the workaround is pretty straight forward. In any case, I could see that behaviour (bug?) tripping up others as well.

Black2vs2 Apr 1, 2024

Wasn't just deleting 2 files enough?

alexeiw123 Apr 1, 2024

Nope, I was already doing that in my many attempts prior

jorgeal94 · 2024-03-14T20:18:04Z

jorgeal94
Mar 14, 2024
Author

I got it working at the end...
#904 Solves the problem on Tesla Addon and now is working as expected, when I got some free time(maybe this weekend) I will make a wiki about how to configure the http tesla proxy with Cloudflared addon, for everybody that is having trouble to configure...
Thanks everybody for replying! I stay here trying to help anyone who need

1 reply

alexeiw123 Mar 14, 2024

That would be really helpful I spent a fair while yesterday to try and get this working and in the end thought I'd best wait for some tested instruction. For some reason cloudflared was showing errors at external requests to the tesla* address when trying to pass it on to NGINX. I used letsencrypt to create SSL certs but I couldn't see a need for duckDNS as above.

cnn888 · 2024-04-01T13:57:42Z

cnn888
Apr 1, 2024

I got it working at the end...

#904 Solves the problem on Tesla Addon and now is working as expected, when I got some free time(maybe this weekend) I will make a wiki about how to configure the http tesla proxy with Cloudflared addon, for everybody that is having trouble to configure...

Thanks everybody for replying! I stay here trying to help anyone who need

Would you uave a timeline when will that wiki be ready? 😊

2 replies

Black2vs2 Apr 1, 2024

https://github.com/llamafilm/tesla-http-proxy-addon/wiki/Specific-setups-how%E2%80%90to

cnn888 Apr 2, 2024

It works!
Thank you

riemers · 2024-04-10T08:00:03Z

riemers
Apr 10, 2024

I was searching and ended up here, and then i found this.. https://www.smartmotion.life/2024/04/06/tesla-integration-with-home-assistant/ i thought i just post it here too.

0 replies

jLynx · 2024-04-30T04:28:36Z

jLynx
Apr 30, 2024

Reading the tutorial I got up to step 5, but when I try and start Tesla HTTP Proxy I get this error

Should I be able to access my tesla.example.com domain myself? Because I get a 502 Bad gateway when trying to access that.
However I can access my ha.example.com and homeassistant-internal.example.com both locally fine

More info:

2024-04-30T04:40:40Z ERR  error="Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: EOF" connIndex=1 event=1 ingressRule=1 originService=https://homeassistant-internal.EXAMPLE.COM
2024-04-30T04:40:40Z ERR Request failed error="Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: EOF" connIndex=1 dest=https://tesla.EXAMPLE.COM/.well-known/appspecific/com.tesla.3p.public-key.pem event=0 ip=198.41.192.227 type=http

2 replies

MelindaJaphines Aug 1, 2024

I'm having the exact same issue as you were having. Did you ever manage to find the solution?

jLynx Aug 15, 2024

sadly, no

dpmeixner · 2024-08-15T21:40:41Z

dpmeixner
Aug 15, 2024

I'm not sure if this will help you, but I was having a similar problem. Deleting the Tesla HTTP Proxy addon and the Tesla Custom Integration, and reinstalling both fixed it for me.

…

On Thu, Aug 15, 2024, 5:06 PM jLynx ***@***.***> wrote: sadly, no — Reply to this email directly, view it on GitHub <#23 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABR7EXJY2WP2PU2QKWH77ATZRUJ5LAVCNFSM6AAAAABERAMLDOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAMZVGI2DMNY> . You are receiving this because you commented.Message ID: <llamafilm/tesla-http-proxy-addon/repo-discussions/23/comments/10352467@ github.com>

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cloudflare argo tunnel configuration #23

{{title}}

Replies: 7 comments 63 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Cloudflare argo tunnel configuration #23

Replies: 7 comments · 63 replies

For the trusted_proxies in configuration.yaml, you only need 172.30.33.0/24. The reason is that Nginx is taking the traffic from Cloudflare that is proxied to the http port of HA. That's why there is "cloudflare: true" in the Nginx add-on config.

llamafilm Apr 1, 2024 Maintainer

jorgeal94 Mar 14, 2024 Author

Replies: 7 comments 63 replies

llamafilm Apr 1, 2024
Maintainer

jorgeal94
Mar 14, 2024
Author