search

papanito / ansible-role-cloudflared

This ansible role does download and install cloudflared on the host and optionally installs the argo-tunnel as a service.
Apache License 2.0
51 stars 13 forks source link

delegate authorized commands to localhost #74

Open hmoffatt opened 1 week ago

hmoffatt commented 1 week ago

From what I can tell, running the tunnel doesn't require the certificate, only creating the tunnel (already out of scope for this role) and running the cloudflared tunnel route commands requires it. So all of those commands could run on localhost via delegate_to and then there would be no need to have the certificate on the remote systems.

This would be more secure because it looks like the certificate allows you to manage all tunnels associated with your account, not just related to the current host.