How to Configure Cloudflare Tunnel for Secure Remote Access to the Analytics Dashboard

You can expose the local Claude Code analytics dashboard to a secure public URL by installing the cloudflared binary and running the CLI with the --tunnel flag, which automatically spawns a Cloudflare Tunnel that proxies your localhost instance without opening firewall ports.

The davila7/claude-code-templates repository includes a CLI tool that serves an analytics dashboard via a local Express server. When you need to view this dashboard from a remote device, the tool integrates with Cloudflare Tunnel to create an encrypted, temporary public URL that requires no manual network configuration.

Architecture Overview

The tunnel integration spans three main components. In cli-tool/src/analytics.js, the ClaudeAnalytics class manages both the local Express server and the tunnel lifecycle. The CLI entry point in cli-tool/src/index.js validates that the --tunnel flag is only used with compatible commands before delegating to the tunnel launcher.

Local Dashboard Server

The dashboard runs on localhost using a dynamically assigned free port or the default 3030. The Express server initializes before any tunnel configuration begins, ensuring the local endpoint is ready before attempting remote exposure.

Tunnel Launcher Implementation

The startCloudflareTunnel() method (lines 1394-1455 in cli-tool/src/analytics.js) spawns a child process running cloudflared tunnel --url http://localhost:<port>. This invocation creates an ephemeral connection to Cloudflare's edge network without requiring permanent tunnel configuration or firewall changes.

URL Detection and Browser Automation

The implementation monitors both stdout and stderr streams for URL patterns matching https://*.cfargotunnel.com or https://*.trycloudflare.com (as referenced in cli-tool/src/chats-mobile.js lines 1110-1118). Upon detection, the CLI prints a boxed banner with the public URL and stores it in this.publicUrl. The openBrowser() method (lines 2350-2362) then automatically launches your default browser to the tunnel address.

Step-by-Step Configuration Guide

Follow these steps to enable secure remote access to your analytics dashboard:

1. Install the cloudflared binary

   Required to create the tunnel connection:

   # macOS (Homebrew)
   
   brew install cloudflare/cloudflare/cloudflared
   
   # Or download directly from Cloudflare's documentation
   

2. Authenticate with Cloudflare

   Run this once to generate a certificate:

   cloudflared tunnel login

   This opens a browser to link your account and stores credentials in ~/.cloudflared/cert.pem. No API keys are stored in the repository.

3. Launch the dashboard with tunnel support

   npx claude-code-templates@latest --analytics --tunnel

   The validation logic in cli-tool/src/index.js (lines 150-155) ensures --tunnel is only accepted alongside supported commands: --analytics, --chats, --2025, or --chats-mobile.

4. Access the public URL

   Wait for the console output showing:

   
   🌍 CLOUDFLARE TUNNEL ACTIVE
   
   https://abcd1234.cfargotunnel.com
   

   The CLI automatically opens this URL; you can also copy it manually from the terminal.

5. Terminate the session

   Press Ctrl+C to stop the CLI. This kills the cloudflared process and invalidates the public URL immediately.

Troubleshooting Common Issues

• Tunnel URL never appears: The watcher reads both output streams and searches for patterns matching cfargotunnel.com or trycloudflare.com. If the URL doesn't appear within 15 seconds, the CLI continues with local-only access and logs a timeout hint (lines 1471-1485).

• Invalid flag combination: Using --tunnel without a supported dashboard command triggers an error from the validation logic in cli-tool/src/index.js.

• Port conflicts: The dashboard automatically selects a random free port if 3030 is unavailable, which the tunnel references dynamically via the this.port variable.

Security Considerations

The tunnel URL is cryptographically unique and private to your session. No authentication credentials are stored in the repository source code, and the tunnel process terminates completely when the CLI exits, rendering the public URL unreachable and preventing persistent external access.

Summary

• Install cloudflared and run cloudflared tunnel login once to authenticate your machine
• Use npx claude-code-templates@latest --analytics --tunnel to start the secured dashboard
• The startCloudflareTunnel() method in cli-tool/src/analytics.js handles automatic tunnel spawning and URL detection
• Public URLs follow the pattern *.cfargotunnel.com or *.trycloudflare.com and expire when the CLI process ends
• A 15-second timeout protects against hanging if the tunnel fails to initialize

Frequently Asked Questions

Do I need a Cloudflare account to use the tunnel feature?

Yes, you must authenticate once using cloudflared tunnel login to generate a certificate in your home directory. This links the ephemeral tunnel to your account without requiring API keys to be stored in the codebase or environment variables.

What happens if the tunnel fails to start?

If the CLI cannot detect a tunnel URL within 15 seconds, it falls back to local-only mode and prints a friendly hint. You can still access the dashboard at localhost:3030 (or the assigned port) on your local machine, but remote access will not be available for that session.

Is the tunnel secure for sensitive analytics data?

Yes. The connection uses TLS encryption through Cloudflare's infrastructure, and the URL is randomly generated and private to your terminal session. Additionally, the tunnel process terminates immediately when you close the CLI, ensuring no persistent external access remains.

Can I use the tunnel with commands other than --analytics?

Yes. According to the validation in cli-tool/src/index.js lines 150-155, the --tunnel flag also works with --chats, --2025, and --chats-mobile commands, all of which launch dashboard variants that support the same remote access functionality.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}