# Using cloudflared with Zero Trust Dashboard on NixOS

**URL:** https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069
**Category:** Help
**Created:** [May 10, 2022, 12:16pm UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069 "2022-05-10T12:16:01Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![boozedog](https://discourse.nixos.org/user_avatar/discourse.nixos.org/boozedog/32/5920_2.png) [@boozedog](https://discourse.nixos.org/u/boozedog)
#### Post date: [May 10, 2022, 12:16pm UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/1 "2022-05-10T12:16:01Z")

</div>

OK so I installed the cloudflared package but I don’t see any options for configuring it ☹

Does anybody have a handy guide I could use? I just want to get cloudflared working with Zero Trust Dashboard, hoping not to do any config in the CLI or anything like that.

FWIW I was able to login using `cloudflared tunnel list` but I don’t know how to run cloudflared as a daemon on NixOS.

---

<div class="post-metadata">

### Author: ![bbigras](https://discourse.nixos.org/user_avatar/discourse.nixos.org/bbigras/32/56_2.png) [@bbigras](https://discourse.nixos.org/u/bbigras)
#### Post date: [May 11, 2022, 12:08am UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/2 "2022-05-11T00:08:31Z")

</div>

We have a nix module in the works. I don’t know how the dashboard work yet, but I can take a look.

[https://github.com/NixOS/nixpkgs/pull/171875](https://github.com/NixOS/nixpkgs/pull/171875)

---

<div class="post-metadata">

### Author: ![bbigras](https://discourse.nixos.org/user_avatar/discourse.nixos.org/bbigras/32/56_2.png) [@bbigras](https://discourse.nixos.org/u/bbigras)
#### Post date: [May 11, 2022, 2:58am UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/3 "2022-05-11T02:58:39Z")

</div>

Do you mean tunnels created in this UI?

 ![image](https://discourse.nixos.org/uploads/default/original/2X/5/53d6caf3f9ebb1cfa94f3c1914acefe433d380db.png)

---

<div class="post-metadata">

### Author: ![boozedog](https://discourse.nixos.org/user_avatar/discourse.nixos.org/boozedog/32/5920_2.png) [@boozedog](https://discourse.nixos.org/u/boozedog)
#### Post date: [May 11, 2022, 10:17am UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/4 "2022-05-11T10:17:33Z")

</div>

@bbigras Yes!

(Here is 20 characters)

---

<div class="post-metadata">

### Author: ![bbigras](https://discourse.nixos.org/user_avatar/discourse.nixos.org/bbigras/32/56_2.png) [@bbigras](https://discourse.nixos.org/u/bbigras)
#### Post date: [May 11, 2022, 2:10pm UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/5 "2022-05-11T14:10:21Z")

</div>

There’s a token if you check the instructions for docker. I’m guessing you should be able to run the tunnel with:

```sh
cloudflared tunnel --no-autoupdate run --token <token>

```

If it works, you could use something like this in your config:

```nix
{
  users.users.cloudflared = {
    group = "cloudflared";
    isSystemUser = true;
  };
  users.groups.cloudflared = { };

  systemd.services.my_tunnel = {
    wantedBy = ["multi-user.target"];
    after = ["network.target"];
    serviceConfig = {
      ExecStart = "${pkgs.cloudflared}/bin/cloudflared tunnel --no-autoupdate run --token=<token>";
      Restart = "always";
      User = "cloudflared";
      Group = "cloudflared";
    };
  };
}

```

**Note** that ideally, `--credentials-file` should be used instead of `--token` since that token is sensitive.

I’ll take a look to see how it could work with the WIP nixos module.

---

<div class="post-metadata">

### Author: ![boozedog](https://discourse.nixos.org/user_avatar/discourse.nixos.org/boozedog/32/5920_2.png) [@boozedog](https://discourse.nixos.org/u/boozedog)
#### Post date: [May 11, 2022, 9:42pm UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/6 "2022-05-11T21:42:39Z")

</div>

@bbigras that worked! Like magic 🙂

---

<div class="post-metadata">

### Author: ![boozedog](https://discourse.nixos.org/user_avatar/discourse.nixos.org/boozedog/32/5920_2.png) [@boozedog](https://discourse.nixos.org/u/boozedog)
#### Post date: [May 12, 2022, 11:56am UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/7 "2022-05-12T11:56:00Z")

</div>

@bbigras OK I spoke little too soon.

Tunnel works great when started up manually from command line. But it doesn’t start correctly when the machine boots:

```auto
May 12 07:42:50 nixos systemd[1]: Started cloudflared.service.
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Starting tunnel tunnelID= *****
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Cannot determine default configuration path. No file [config.yml config.yaml] in [~/.cloudflared ~>
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Version 2022.5.0
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF GOOS: linux, GOVersion: go1.17.9, GoArch: amd64
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Settings: map[no-autoupdate:true token: *****]
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Generated Connector ID: *****
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Will be fetching remotely managed configuration from Cloudflare API. Defaulting to protocol: quic
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Initial protocol quic
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR update check failed error="Get \"https://update.argotunnel.com?arch=amd64&clientVersion=2022.5.0&o>
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR Error looking up Cloudflare edge IPs: the DNS query failed error="lookup _origintunneld._tcp.argot>
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR Please try the following things to diagnose this issue:
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR 1. ensure that argotunnel.com is returning "origintunneld" service records.
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR Run your system's equivalent of: dig srv _origintunneld._tcp.argotunnel.com
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR 2. ensure that your DNS resolver is not returning compressed SRV records.
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR See GitHub issue https://github.com/golang/go/issues/27546
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR For example, you could use Cloudflare's 1.1.1.1 as your resolver:
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Tunnel server stopped
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z ERR Initiating shutdown error="Could not lookup srv records on _origintunneld._tcp.argotunnel.com: loo>
May 12 07:42:50 nixos cloudflared[726]: 2022-05-12T11:42:50Z INF Starting metrics server on 127.0.0.1:35203/metrics
May 12 07:42:51 nixos cloudflared[726]: 2022-05-12T11:42:51Z INF Metrics server stopped
May 12 07:42:51 nixos cloudflared[726]: Could not lookup srv records on _origintunneld._tcp.argotunnel.com: lookup _origintunneld._tcp.argotunnel.com on [::1]:53: >
May 12 07:42:51 nixos systemd[1]: cloudflared.service: Main process exited, code=exited, status=1/FAILURE
May 12 07:42:51 nixos systemd[1]: cloudflared.service: Failed with result 'exit-code'.
May 12 07:42:51 nixos systemd[1]: cloudflared.service: Consumed 52ms CPU time, received 0B IP traffic, sent 160B IP traffic.
May 12 07:42:51 nixos systemd[1]: cloudflared.service: Scheduled restart job, restart counter is at 5.
May 12 07:42:51 nixos systemd[1]: Stopped cloudflared.service.
May 12 07:42:51 nixos systemd[1]: cloudflared.service: Consumed 52ms CPU time, received 0B IP traffic, sent 160B IP traffic.
May 12 07:42:51 nixos systemd[1]: cloudflared.service: Start request repeated too quickly.
May 12 07:42:51 nixos systemd[1]: cloudflared.service: Failed with result 'exit-code'.
May 12 07:42:51 nixos systemd[1]: Failed to start cloudflared.service.

```

Seems like DNS resolver isn’t accepting queries when cloudflared service tries to start?

---

<div class="post-metadata">

### Author: ![bbigras](https://discourse.nixos.org/user_avatar/discourse.nixos.org/bbigras/32/56_2.png) [@bbigras](https://discourse.nixos.org/u/bbigras)
#### Post date: [May 12, 2022, 2:06pm UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/8 "2022-05-12T14:06:56Z")

</div>

maybe try with:

`after = ["network-online.target" "systemd-resolved.service"];`

---

<div class="post-metadata">

### Author: ![boozedog](https://discourse.nixos.org/user_avatar/discourse.nixos.org/boozedog/32/5920_2.png) [@boozedog](https://discourse.nixos.org/u/boozedog)
#### Post date: [May 12, 2022, 2:28pm UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/9 "2022-05-12T14:28:26Z")

</div>

That did the trick. Thanks again!

---

<div class="post-metadata">

### Author: ![boozedog](https://discourse.nixos.org/user_avatar/discourse.nixos.org/boozedog/32/5920_2.png) [@boozedog](https://discourse.nixos.org/u/boozedog)
#### Post date: [December 7, 2022, 7:30pm UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/10 "2022-12-07T19:30:01Z")

</div>

@bbigras hey there just checking in, is the solution above still the preferred way to use `cloudflared` tunnels?

---

<div class="post-metadata">

### Author: ![bbigras](https://discourse.nixos.org/user_avatar/discourse.nixos.org/bbigras/32/56_2.png) [@bbigras](https://discourse.nixos.org/u/bbigras)
#### Post date: [December 14, 2022, 4:08am UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/11 "2022-12-14T04:08:15Z")

</div>

You might want to try [nixos/cloudflared: init by bbigras · Pull Request #171875 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/pull/171875) which was recently merged.

---

<div class="post-metadata">

### Author: ![gaidenko](https://discourse.nixos.org/letter_avatar_proxy/v4/letter/g/c68b51/32.png) [@gaidenko](https://discourse.nixos.org/u/gaidenko)
#### Post date: [August 9, 2025, 6:30pm UTC](https://discourse.nixos.org/t/using-cloudflared-with-zero-trust-dashboard-on-nixos/19069/12 "2025-08-09T18:30:47Z")

</div>

[NixOS Web Services with Cloudflared: A Complete Guide - YouTube](https://www.youtube.com/watch?v=c5Hx4osU5A8) ~ [[Why Does Nothing Work]]