skills.rest
mmnavarr
mmnavarrCOMMUNITY
Explore all skills by this author →
Website𝕏@mxlcolmGitHub

cloudflare-access-railway-gating

Migrate Railway services from public URLs to Cloudflare Access-gated domains via tunnels.

Updated May 11, 2026
Search Tags:#devops#railway#zero trust#ingress#cloudflared#cloudflare tunnel#cloudflare access
One-click install
npx skills add https://github.com/mmnavarr/harness --skill cloudflare-access-railway-gating-mmnavarr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloudflare-access-railway-gating
Source: https://github.com/mmnavarr/harness/tree/main/skills/cloudflare-access-railway-gating
Command: npx skills add https://github.com/mmnavarr/harness --skill cloudflare-access-railway-gating-mmnavarr

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Railway-hosted services expose public .up.railway.app URLs by default, leaving internal tools unprotected. This Skill guides the migration of those services behind Cloudflare Access zero-trust authentication using Cloudflare Tunnels, private Railway networking, and per-project cloudflared connectors. ## Core Features & Use Cases - Tunnel and Connector Setup: Create Cloudflare Tunnels per Railway project, deploy cloudflared connector services, and configure tunnel ingress routing to private railway.internal origins. - Access App and DNS Configuration: Create Cloudflare Access applications with reusable SSO policies, proxied CNAME records, and path-based bypass rules for webhooks and OAuth callbacks. - Gating Strategies: Choose between gating the root domain with webhook bypasses or gating only UI paths for API-heavy services like LiteLLM, plus service tokens for machine-to-machine access. - Use Case: Move an internal N8N instance from n8n.up.railway.app to n8n.example.xyz gated behind Cloudflare Access SSO, while keeping /webhook paths open for external integrations. ## Quick Start Ask the AI to gate a Railway service behind Cloudflare Access by creating a tunnel, deploying cloudflared, and configuring the Access app, DNS, and ingress rules.

Frequently Asked Questions about cloudflare-access-railway-gating

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gate a Railway service behind Cloudflare Access?▼

Create a Cloudflare Tunnel per Railway project, deploy a cloudflared connector service with the tunnel token, remove the public Railway domain, then create an Access application, a proxied CNAME to the tunnel, and a tunnel ingress rule pointing to the service's private railway.internal address and port.

How do I bypass Cloudflare Access for webhook paths?▼

Create a separate Access application scoped to the webhook path with a bypass decision policy including everyone. More-specific path apps take precedence over the root domain app, so /webhook reaches the origin while the rest of the domain stays gated.

Why does cloudflared show connection refused to my Railway service?▼

Connection refused usually means a wrong port or bind address. Check deploy logs for the actual listening port, and note that Next.js 15 requires HOSTNAME=0.0.0.0 rather than HOST, while Railway private networking resolves to IPv6 only.

Can Railway services in different projects communicate privately?▼

No, Railway private networks are project-isolated and railway.internal DNS only resolves within the same project. Cross-project options include Railway's public TCP proxy for databases, HTTP calls through Cloudflare Access service tokens, or consolidating services into one project.

How do service tokens work with Cloudflare Access?▼

Create an account-level service token, then add a non_identity policy with the any_valid_service_token include rule to each Access app. Clients authenticate by sending CF-Access-Client-Id and CF-Access-Client-Secret headers, bypassing the SSO flow for machine-to-machine calls.

Why do Railway healthchecks fail when binding to :: for IPv6?▼

Railway containers set net.ipv6.bindv6only=1, so binding to :: in Python or Node.js listens on IPv6 only while Railway healthchecks use IPv4. Either disable the healthcheck for tunnel-only services or run an IPv6-to-IPv4 TCP proxy alongside the app.

Related Skills

Explore More Software Engineering Skills→
ecnepsyroc-botecnepsyroc-bot

cloudflare-tunnel

Manage Cloudflare tunnels and DNS records to expose local services.

Community
Intermediate
bharthraj1412bharthraj1412

Heartbeat

Automate periodic system health checks across services and hosts.

Community
Advanced
automateyournetworkautomateyournetwork
650

cloudflare-zerotrust

Inspect Cloudflare Zero Trust access applications, policies, tunnels, and CASB findings.

Community
Basic
TitoPrauseeTitoPrausee

tailscale-docker

Configure Tailscale in Docker containers using userspace networking and SOCKS5 proxy.

Community
Intermediate