Install Pando

Cloudflare Tunnel

cloudflare Gives apps their own hostnames through a Cloudflare Tunnel. Nothing on this machine needs to be reachable from the internet, and Cloudflare issues the certificates.

Setup

  1. Create an API token

    1. In Cloudflare, open Manage account → Account API tokens for an account token, or My Profile → API Tokens for a user token.
    2. Choose Create Token, then a custom token.
    3. Add these permissions:
      ScopeResourceAccess
      AccountCloudflare TunnelEdit
      ZoneDNSEdit
      ZoneZoneRead
    4. Under Account Resources, include your account. Under Zone Resources, include each zone apps will use.

    Open the Cloudflare dashboardOpen user API tokens

    Settings api_token

  2. Find your account ID

    1. Open one of your domains and copy Account ID from the API section of its Overview page.

    Open Cloudflare

    Settings account_id

  3. Choose zones

    Settings zone, other_zones, console_hostname

Settings (7)
api_tokenAPI tokenRequiredCredential

In Cloudflare, create a custom token under Manage account, Account API tokens, or under My Profile, API Tokens. Permissions: Account / Cloudflare Tunnel / Edit; Zone / DNS / Edit; Zone / Zone / Read. Account Resources: your account. Zone Resources: the primary zone, and each secondary zone. Pando uses it to create the tunnel and to point each app's hostname at it.

string

account_idAccount IDRequired

On your domain's Overview page in Cloudflare, under API.

string · For example 0123456789abcdef0123456789abcdef

zonePrimary zoneRequired

A domain on your Cloudflare account. New apps are served at <app>.<zone>.

string · For example example.com

other_zonesSecondary zones

More zones apps can be named in.

string · For example example.org

console_hostnameConsole hostname

Where the console is served. Empty is the primary zone.

string · For example pando.example.com

tunnel_idExisting tunnelAdvanced

Leave empty and Pando creates a tunnel of its own. Or give a remotely managed tunnel's ID to use that one: Pando adds its rules and leaves the rest alone.

string · Default A tunnel of Pando's own

imagecloudflared imageAdvanced

Set to run a different cloudflared release than this Pando ships with.

string · Default cloudflare/cloudflared:2025.1.0