2.1 KiB
Cloudflare Tunnel
Use the README quick start for a basic config.yaml and the
Kobo's Instapaper settings.
Publish the app
For a simple Tunnel route, set public_url to your public HTTPS origin in
config.yaml.
public_url: "https://readeckobo.example.com"
Before making the hostname public, add a Cloudflare WAF custom
rule with Block action
for (http.host eq "readeckobo.example.com" and http.request.uri.path eq "/api/convert-image"). This direct, unauthenticated endpoint fetches a
caller-provided URL and is not needed by the prefixed Kobo article routes. The
Tunnel can still forward all other paths without path-specific routing rules.
Add a published application route to a connected Cloudflare Tunnel:
| Route setting | Example |
|---|---|
| Public hostname | readeckobo.example.com |
| Service URL | http://localhost:8080 |
Use the actual address cloudflared can reach: localhost works when it runs
on the same host as the published app port, not when it runs in a separate
container. Forward all paths to the app without a path rule. Go proxies Kobo
Store traffic and rewrites initialization so Kobo continues sending Instapaper
requests to readeckobo.
Verify and secure
Check that initialization points back to your hostname:
curl --compressed -fsS https://readeckobo.example.com/instapaper-proxy/storeapi/v1/initialization \
| grep -F 'https://readeckobo.example.com/instapaper-proxy/instapaper'
Then check sync on a real Kobo. Browser login or bot challenges at the edge may
block its requests. docker-compose.yml publishes port 8080 on all interfaces:
restrict direct HTTP access with a firewall, or bind the port to
127.0.0.1:8080:8080 if cloudflared runs on the host. If it runs in another
container or host, use a private network instead. Keep device tokens and request
URLs containing them private.
For Kobo ebook syncing with a compatible service, see Kobo ebook sync. The same Tunnel route forwards those requests to readeckobo.