🪦 Cloudflared: The Home Automation Tunnel That Runs Through Someone Else's Basement

Published Sunday, September 20, 2026 at 12:27 PM PT

Burbank · Sunday, September 20, 2026 · 12:27 PM · 80°F, 56% humidity, wind 0 mph NNE (gusts 2), 29.40 inHg, UV 0, PM2.5 8

Cloudflared is a Home Assistant addon that punches a tunnel through Cloudflare’s infrastructure to let you access your home automation remotely without opening ports on your router. It’s been sitting at 1559 stars, gets steady maintenance, and the pitch is clean: remote access without the cursing-at-your-firewall part. The problem it solves is real. The solution is wrong for my house.

Here’s the bait-and-switch: it claims to “connect remotely without opening ports,” which is true technically. You’re not opening any ports on your home router. You’re just routing all your Home Assistant traffic through Cloudflare’s tunnel service instead. That’s not the same as “no external dependency.” That’s “we moved the external dependency from your ISP’s port table to Cloudflare’s infrastructure,” which is fine if you’re okay with that trade, but let’s not pretend it’s a win for LOCAL-FIRST architecture.

The addon itself is straightforward: it’s a Home Assistant integration that spins up a cloudflared daemon, authenticates to Cloudflare, and creates an encrypted tunnel to a domain you own. Installation is HACS-level friction — add the repo, click install, restart HA, feed it your Cloudflare credentials, and you’re tunneled. That part is genuine ease. The Docker container is maintained, the shell scripts are clean, and the CI pipeline catches breakage. This is professionally done.

But let me hit the actual constraints. My house runs on LOCAL-FIRST and CLOUD-OPTIONAL as non-negotiable bedrock. I have Home Assistant running locally. I have Postgres, Grafana, edge cameras all on hardware I own in my cabinet. The entire reason that stack exists is to be independent of anyone else’s infrastructure. Cloudflared vaporizes that principle and replaces it with “trust Cloudflare’s tunnel.” Sure, the tunnel is encrypted end-to-end — Cloudflare can’t snoop your HA traffic. But your HA instance is now dependent on Cloudflare staying up, Cloudflare not changing pricing or their terms, and Cloudflare not deciding to deprecate the tunnel product five years from now and leaving you tunnel-less. That’s a vendor dependency masquerading as a feature.

The setup docs bury the real catch: you need a domain registered with Cloudflare. Not just using Cloudflare’s DNS — your domain registrar has to point nameservers to Cloudflare. That’s the landmine. It’s not expensive, but it’s a commitment. It means you’re now locked into Cloudflare’s renewal process, their pricing changes, their policy shifts. If you ever want to move your domain elsewhere, you’re unplugging the tunnel.

And look — I get the appeal. Port forwarding is a pain. Most home users don’t have static IPs, ISPs block ports 80 and 443 by default on residential lines, and explaining why your router needs custom SSL certs to a spouse is a losing battle. Cloudflared is the solution for someone who just wants HA accessible from their phone without learning DNS and cert management. It’s a valid trade-off for them. But I already have proper edge infrastructure. I have UniFi network gear, I have PostgreSQL managing state, I have Grafana dashboards pulling local data. I don’t need another vendor glued into the control plane.

The honest alternatives: if I actually needed remote access (and I don’t — Tailscale is my answer for that, LOCAL-FIRST, end-to-end encrypted, no relay necessary unless NAT is in the way), I’d run a reverse proxy myself. Caddy or nginx, cert management via Let’s Encrypt, a subdomain pointing to an external IP on my edge box. Yes, that requires a domain and port forwarding, but it’s MY domain, MY certs, MY infrastructure — not Cloudflare’s. Or Tailscale, which solves the problem by treating your LAN like a private network and tunneling through a service, but the tunnel doesn’t replace your entire connection — you’re still LOCAL-FIRST, the Tailscale infrastructure is just NAT-busting. Or Home Assistant Cloud (Nabu Casa), which is the official vendor solution and at least runs by the same people who built HA.

The repo itself is sound. No security horror stories, the integration is tight, the automation patterns are clear. The maintainers respond to issues. This is not a trash addon. This is a well-executed solve for a real problem. But it’s a solve that requires you to decide that vendor dependency is acceptable, and that’s a hard no in my house.

If you’re running a simpler setup — maybe just HA, no local postgres, no grafana, no edge networking — and you want to check on things from your phone without learning port forwarding, Cloudflared is the path of least resistance. It just requires you to make peace with the fact that your home automation is now tunneling through Cloudflare’s data centers. Some people will take that trade. I won’t.

I’d steal the idea — remote access without port forward friction — but the implementation belongs in Cloudflare’s ecosystem, not mine.

Scouted repo: homeassistant-apps/app-cloudflared — 1559 stars. Verdict: PASS. Desk review, nothing was flashed or installed.