# Cloudflare Tunnel

Kody needs an HTTPS URL. Cloudflare Tunnel forwards that hostname to this
process on `127.0.0.1:4040` (or the Docker published port) without opening
inbound firewall ports.

Use Cloudflare's current install and tunnel docs rather than a click-by-click
dashboard walkthrough. Those pages stay accurate as the dashboard moves:

- [Install `cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/)
- [Create a tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/)
- [Run as a service](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/as-a-service/)
- [Public hostnames](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/routing-to-tunnel/)

## Shape

1. Install `cloudflared` on the same machine (or NAS) that runs Home MCP.
2. Authenticate and create a tunnel.
3. Route a hostname you control to `http://127.0.0.1:4040`.
4. Keep the connector running as a service so the hostname stays up across
   reboots.

If Home MCP runs in Docker and publishes `4040:4040`, the tunnel target is still
`http://127.0.0.1:4040` on the host. Do not point the tunnel at the container's
internal IP unless you understand that network.

## Public base URL

Set `HOME_MCP_PUBLIC_BASE_URL` to the HTTPS origin you routed — no trailing
slash. The MCP URL is that origin plus `/mcp`. OAuth issuer, authorization
endpoint, and the RFC 8707 `resource` value all derive from this setting.

Example:

```bash
HOME_MCP_PUBLIC_BASE_URL=https://home.example.com
```

Kody then connects to `https://home.example.com/mcp`.

## After the tunnel is up

Add [Cloudflare Access](./cloudflare-access.md) so a stranger who finds the
hostname cannot approve OAuth clients. Then
[connect Kody](./connecting-kody.md).