# How to Configure Cloudflare Tunnel for Secure Remote Access to the Analytics Dashboard > Securely access your analytics dashboard remotely by configuring Cloudflare Tunnel. This guide shows how to use cloudflared to proxy your localhost without opening firewall ports. - Repository: [Daniel Avila/claude-code-templates](https://github.com/davila7/claude-code-templates) - Tags: how-to-guide - Published: 2026-04-26 --- **You can expose the local Claude Code analytics dashboard to a secure public URL by installing the `cloudflared` binary and running the CLI with the `--tunnel` flag, which automatically spawns a Cloudflare Tunnel that proxies your localhost instance without opening firewall ports.** The davila7/claude-code-templates repository includes a CLI tool that serves an analytics dashboard via a local Express server. When you need to view this dashboard from a remote device, the tool integrates with Cloudflare Tunnel to create an encrypted, temporary public URL that requires no manual network configuration. ## Architecture Overview The tunnel integration spans three main components. In [`cli-tool/src/analytics.js`](https://github.com/davila7/claude-code-templates/blob/main/cli-tool/src/analytics.js), the `ClaudeAnalytics` class manages both the local Express server and the tunnel lifecycle. The CLI entry point in [`cli-tool/src/index.js`](https://github.com/davila7/claude-code-templates/blob/main/cli-tool/src/index.js) validates that the `--tunnel` flag is only used with compatible commands before delegating to the tunnel launcher. ### Local Dashboard Server The dashboard runs on **localhost** using a dynamically assigned free port or the default **3030**. The Express server initializes before any tunnel configuration begins, ensuring the local endpoint is ready before attempting remote exposure. ### Tunnel Launcher Implementation The `startCloudflareTunnel()` method (lines 1394-1455 in [`cli-tool/src/analytics.js`](https://github.com/davila7/claude-code-templates/blob/main/cli-tool/src/analytics.js)) spawns a child process running `cloudflared tunnel --url http://localhost:`. This invocation creates an ephemeral connection to Cloudflare's edge network without requiring permanent tunnel configuration or firewall changes. ### URL Detection and Browser Automation The implementation monitors both `stdout` and `stderr` streams for URL patterns matching `https://*.cfargotunnel.com` or `https://*.trycloudflare.com` (as referenced in [`cli-tool/src/chats-mobile.js`](https://github.com/davila7/claude-code-templates/blob/main/cli-tool/src/chats-mobile.js) lines 1110-1118). Upon detection, the CLI prints a boxed banner with the public URL and stores it in `this.publicUrl`. The `openBrowser()` method (lines 2350-2362) then automatically launches your default browser to the tunnel address. ## Step-by-Step Configuration Guide Follow these steps to enable secure remote access to your analytics dashboard: 1. **Install the cloudflared binary** Required to create the tunnel connection: ```bash # macOS (Homebrew) brew install cloudflare/cloudflare/cloudflared # Or download directly from Cloudflare's documentation ``` 2. **Authenticate with Cloudflare** Run this once to generate a certificate: ```bash cloudflared tunnel login ``` This opens a browser to link your account and stores credentials in `~/.cloudflared/cert.pem`. No API keys are stored in the repository. 3. **Launch the dashboard with tunnel support** ```bash npx claude-code-templates@latest --analytics --tunnel ``` The validation logic in [`cli-tool/src/index.js`](https://github.com/davila7/claude-code-templates/blob/main/cli-tool/src/index.js) (lines 150-155) ensures `--tunnel` is only accepted alongside supported commands: `--analytics`, `--chats`, `--2025`, or `--chats-mobile`. 4. **Access the public URL** Wait for the console output showing: ``` 🌍 CLOUDFLARE TUNNEL ACTIVE https://abcd1234.cfargotunnel.com ``` The CLI automatically opens this URL; you can also copy it manually from the terminal. 5. **Terminate the session** Press **Ctrl+C** to stop the CLI. This kills the `cloudflared` process and invalidates the public URL immediately. ## Troubleshooting Common Issues - **Tunnel URL never appears**: The watcher reads both output streams and searches for patterns matching `cfargotunnel.com` or `trycloudflare.com`. If the URL doesn't appear within **15 seconds**, the CLI continues with local-only access and logs a timeout hint (lines 1471-1485). - **Invalid flag combination**: Using `--tunnel` without a supported dashboard command triggers an error from the validation logic in [`cli-tool/src/index.js`](https://github.com/davila7/claude-code-templates/blob/main/cli-tool/src/index.js). - **Port conflicts**: The dashboard automatically selects a random free port if 3030 is unavailable, which the tunnel references dynamically via the `this.port` variable. ## Security Considerations The tunnel URL is cryptographically unique and private to your session. No authentication credentials are stored in the repository source code, and the tunnel process terminates completely when the CLI exits, rendering the public URL unreachable and preventing persistent external access. ## Summary - Install `cloudflared` and run `cloudflared tunnel login` once to authenticate your machine - Use `npx claude-code-templates@latest --analytics --tunnel` to start the secured dashboard - The `startCloudflareTunnel()` method in [`cli-tool/src/analytics.js`](https://github.com/davila7/claude-code-templates/blob/main/cli-tool/src/analytics.js) handles automatic tunnel spawning and URL detection - Public URLs follow the pattern `*.cfargotunnel.com` or `*.trycloudflare.com` and expire when the CLI process ends - A 15-second timeout protects against hanging if the tunnel fails to initialize ## Frequently Asked Questions ### Do I need a Cloudflare account to use the tunnel feature? Yes, you must authenticate once using `cloudflared tunnel login` to generate a certificate in your home directory. This links the ephemeral tunnel to your account without requiring API keys to be stored in the codebase or environment variables. ### What happens if the tunnel fails to start? If the CLI cannot detect a tunnel URL within 15 seconds, it falls back to local-only mode and prints a friendly hint. You can still access the dashboard at `localhost:3030` (or the assigned port) on your local machine, but remote access will not be available for that session. ### Is the tunnel secure for sensitive analytics data? Yes. The connection uses TLS encryption through Cloudflare's infrastructure, and the URL is randomly generated and private to your terminal session. Additionally, the tunnel process terminates immediately when you close the CLI, ensuring no persistent external access remains. ### Can I use the tunnel with commands other than `--analytics`? Yes. According to the validation in [`cli-tool/src/index.js`](https://github.com/davila7/claude-code-templates/blob/main/cli-tool/src/index.js) lines 150-155, the `--tunnel` flag also works with `--chats`, `--2025`, and `--chats-mobile` commands, all of which launch dashboard variants that support the same remote access functionality.