Every local container gets a real HTTPS address.

Run projects on your laptop. Open them from any device at https://<project>.dev.yourdomain.com, with a trusted certificate and nothing to install on the client.

$ npm install -g devtun
A request travels from the browser to the Cloudflare edge, through a tunnel, to Traefik, then to your container. Browser anywhere Cloudflare edge TLS ends here cloudflared QUIC tunnel Traefik routes by Host() myapp:3000 your container https tunnel http http your machine, Docker

Cloudflare terminates TLS at the edge. The tunnel carries plain HTTP to Traefik, which matches the hostname to a container label. No local certificates, no port forwarding, no inbound firewall rules.

Add a project, get a URL.

From inside a project that already has a Docker Compose file, tell devtun the project name, the service to expose, and the port it listens on. devtun creates the DNS record, requests an edge certificate, and adds the Traefik labels.

Share the link with a teammate, point a webhook at it, or open it on your phone. It stays up as long as the container does.

# in ~/code/myapp
$ devtun add myapp web 3000

Adding myapp.dev.example.com

Step 1: Cloudflare DNS...
  Creating DNS: myapp.dev.example.com -> tunnel-origin.example.com
  Registering custom hostname with SSL...
  Registered (SSL: pending_validation)

Step 2: Docker Compose override...
  Updated docker-compose.override.yml (web:3000, cache=all)

Restart containers to apply changes? (docker compose up -d) [y/N] y

  https://myapp.dev.example.com/ will be live once SSL activates.
  Check status with: devtun status myapp

One setup, then forget about it.

devtun setup walks through the configuration and does each step in order. If it gets interrupted, run it again: every step checks whether it has already been done.

The only manual step is switching on Cloudflare for SaaS in the dashboard the first time. Setup detects when that is needed and gives you the link.

Why Cloudflare for SaaS? Universal SSL covers *.example.com but wildcards only reach one level, so *.dev.example.com is out. Cloudflare for SaaS issues a separate edge certificate per hostname, free for up to 100. devtun handles the whole exchange.
  1. Create the config ~/.devtun/config.json
  2. Check Docker is running
  3. Look up your Cloudflare zone
  4. Create or reuse a Cloudflare Tunnel
  5. Configure SSL mode and Universal SSL
  6. Enable Cloudflare for SaaS and the fallback origin
  7. Start Traefik and the tunnel generated Docker Compose file

Built from things you already run.

Traefik

Discovers containers through Docker labels and routes each hostname to the right service. Nothing to restart when you add a project.

Cloudflare Tunnel

Outbound-only connection from your machine to Cloudflare's edge. Works behind NAT, on hotel wifi, on a laptop that moves between networks.

Your API token

Scoped to one zone with DNS, SSL and zone-settings edit access. Supply it as an environment variable, a 1Password CLI reference, or in the config.