Exposing Development Environments with Cloudflare Tunnel and WARP Without Opening Ports

I needed a development environment with frequent deployments, public HTTPS URLs and convenient access to the databases for debugging. What I didn't want was a server sitting on the Internet with ports 80 and 443 open, waiting to be scanned.

Those requirements pull in opposite directions: the easier the access, the bigger the exposure. This is the story of the combination that worked for me:

• Cloudflare Tunnel to publish the apps without opening ports 80 and 443.
• Traefik as the internal router, with per-application labels.
• Portainer to manage the containers.
• Cloudflare One WARP to reach the private Docker network only from my machine.

Design

I'll explain the design, the detail that breaks Laravel behind the proxy and, above all, the risks.