> ## Documentation Index
> Fetch the complete documentation index at: https://www.towbar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Connect Cloudflare DNS and tunnels for workload ingress and TLS.

Towbar uses one installation-wide Cloudflare integration for owned DNS records, DNS-validated TLS, and tunnel ingress. Create a scoped account API token under Cloudflare's **Manage Account → Account API Tokens** with **Zone → Zone → Read**, **Zone → DNS → Edit**, and **Zone → Zone Settings → Read** for the intended zones. Zone Settings Read lets Towbar verify Full (strict) SSL/TLS mode. The token stays in the root-owned control-plane YAML file; workloads choose their routing policy in the manifest.

```yaml title="/etc/towbar/towbar.yml" theme={"system"}
integrations:
  cloudflare:
    enabled: true
    accountId: "<account-id>"
    zoneId: "<optional-zone-id>"
    apiToken: "<scoped-account-token>"
```

`zoneId` is optional when the token can discover the required zone. Omit the field rather than leaving an empty value. Towbar supplies a reviewed digest-pinned `cloudflaredImage` by default; if you set it explicitly, use a Towbar-supported pinned image. Run `sudo towbar config validate` and `sudo towbar restart`, then confirm Cloudflare appears under **Manage → Integrations → Platform services**.

## Use it from a manifest

For a public workload, configure its domain and choose the relevant DNS or tunnel mode in the [Domains and TLS](/docs/domains-tls#cloudflare-tls) guide. The manifest refers to Cloudflare behavior but never contains the API token. A deployment that requests Cloudflare TLS is blocked when the integration is not configured; the configured status alone does not prove that the token can change a particular zone.

## Verify and troubleshoot

Deploy a non-production route in an authorized zone. Confirm the DNS record, certificate status, and actual HTTPS response. If an operation fails, compare the domain's zone with the token scope, check zone discovery or `zoneId`, and inspect the route operation error. Rotate the token in YAML, restart, and verify an owned route before revoking the old token. Towbar manages only records it owns; review existing DNS before assigning a hostname.

<div className="towbar-doc-screenshot">
  <div className="towbar-product-light">
    <img src="https://mintcdn.com/avgeek/EgLPXnoUAEgajpP9/assets/release-v2/cloudflare-setup-light.jpg?fit=max&auto=format&n=EgLPXnoUAEgajpP9&q=85&s=ef507751483b4bf2b7c2505903987f51" alt="Cloudflare integration settings in Towbar." width="2560" height="1440" loading="lazy" data-path="assets/release-v2/cloudflare-setup-light.jpg" />
  </div>

  <div className="towbar-product-dark">
    <img src="https://mintcdn.com/avgeek/EgLPXnoUAEgajpP9/assets/release-v2/cloudflare-setup-dark.jpg?fit=max&auto=format&n=EgLPXnoUAEgajpP9&q=85&s=925ecd7215afbf8bf90d85a2352961b8" alt="Cloudflare integration settings in Towbar." width="2560" height="1440" loading="lazy" data-path="assets/release-v2/cloudflare-setup-dark.jpg" />
  </div>

  <p>
    The Cloudflare page shows the runtime provider used for managed DNS, TLS,
    and tunnel ingress.
  </p>
</div>