Any service, with Docker

What you need

• A machine in your network with Docker and Docker Compose: a Linux server, a NAS, a Raspberry Pi.
• A DNSalsa account with Remote. The first month is free, and you pay nothing during it.

Set it up

1. Start the connector

   Save compose.yaml in an empty folder and run:

   docker compose up -d

2. Get the pairing code

   Open http://127.0.0.1:8099 on that machine. On a server without a browser, run docker logs dnsalsa-connector. Both show a code like K7QP-4XM2.

3. Create a hostname with a route

   In your dashboard, pick a name and open Setup → Cloudflare Tunnel. As the route, enter the address of the service the way the container reaches it: http://192.168.1.20:8123 for a service on another machine, http://host.docker.internal:8123 for one on the same machine.

4. Pair

   Choose DNSalsa connector and enter the code. Within a few seconds the tunnel runs, and your address works.

5. Keep it up to date

   Run docker compose pull && docker compose up -d now and then, or let a tool like Watchtower or Diun tell you about new versions.

Home Assistant Container or Core

The connector notices when the route leads to Home Assistant and checks that Home Assistant trusts the tunnel. If not, its page shows the steps. In configuration.yaml it comes down to:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.57.0/24   # Home Assistant on the same machine as the connector

Home Assistant on another machine sees the traffic come from the LAN IP of the machine that runs the connector. Put that IP in trusted_proxies instead.

Keep it safe

The connector runs read-only, without extra privileges, and only opens an outbound connection, so your router stays closed. Anything you put on the route becomes reachable from the internet: only route services with a proper login, and turn on two-factor authentication where you can.

Other setups: Home Assistant · TrueNAS · Docker