Enables secure, authenticated public access to an OpenClaw Gateway WebUI using Cloudflare Tunnels and Zero Trust policies.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install openclaw-cloudflare-secure
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install openclaw-cloudflare-secure using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is OpenClaw Cloudflare Secure?
The OpenClaw Cloudflare Secure skill is designed for developers who need to expose their OpenClaw WebUI on a VPS without the risks associated with open public ports. It utilizes Cloudflare Tunnel (cloudflared) to create an encrypted, outbound-only connection to the Cloudflare edge, effectively hiding the server's IP address.
This workflow is a critical component of professional Openclaw Skills implementations, as it integrates identity-based authentication through Cloudflare Access. By leveraging this skill, users can manage DNS records programmatically and ensure that their AI agent interfaces are only accessible to authorized personnel via custom hostnames.
OpenClaw Cloudflare Secure Use Cases
- Deploying a production-ready OpenClaw WebUI on a remote VPS protected by identity-based access control.
- Automating the transition from peer-to-peer networking like Tailscale to a public-facing DNS structure.
- Securing AI management interfaces behind SSO or email-based allowlists.
- Reducing the attack surface of a VPS by closing all inbound ports while maintaining external access.
How OpenClaw Cloudflare Secure Works
- The skill identifies the local OpenClaw service running on the VPS, typically at http://127.0.0.1:18789.
- It installs and configures the cloudflared daemon as a system service using a provided Zero Trust token.
- A specialized Python helper script manages the Cloudflare API to perform a DNS cutover, removing conflicting records.
- A CNAME record is created to point the custom hostname to the unique Cloudflare Tunnel UUID.
- The Cloudflare edge is configured to route traffic through the tunnel directly to the local service port.
- Zero Trust Access policies are enforced at the edge, requiring authentication before traffic ever reaches the VPS.
OpenClaw Cloudflare Secure Setup
Prerequisites
- A Cloudflare account with a managed domain.
- A Cloudflare API Token with Zone:DNS:Edit permissions.
Installation Steps
- Install the tunnel service:
./scripts/install_cloudflared.sh
sudo ./scripts/tunnel_service_install.sh '<YOUR_CLOUDFLARE_TUNNEL_TOKEN>'
- Configure DNS management:
export CLOUDFLARE_API_TOKEN='your_token_here'
- Point hostname to the tunnel:
./scripts/dns_point_hostname_to_tunnel.sh \
--zone example.com \
--hostname openclaw.example.com \
--tunnel-uuid <TUNNEL_UUID>
OpenClaw Cloudflare Secure Data Schema & Taxonomy
The skill utilizes a set of scripts and environment variables to manage the lifecycle of the secure connection:
| Component | Purpose |
|---|---|
cf_dns.py |
Core Python logic for interfacing with the Cloudflare DNS API. |
dns_create_record.sh |
Shell script for programmatic creation of A, AAAA, and CNAME records. |
tunnel_service_install.sh |
Automates the systemd registration of the cloudflared connector. |
CLOUDFLARE_API_TOKEN |
Required environment variable for authenticated DNS modifications. |
TUNNEL_UUID |
Unique identifier for the Cloudflare Tunnel routing. |
OpenClaw Cloudflare Secure Advanced Features
- Agent-friendly DNS management allowing AI agents to create subdomains with restricted API tokens.
- Automatic detection and removal of existing DNS collisions during the cutover process.
- Full support for proxied (orange cloud) records required for Cloudflare Access enforcement.
- Optional rollback procedures to reset Tailscale Serve configurations and disable tunnel services.
SKILL.md
Loading
Related Openclaw Skills
Smart Model Router
An intelligent routing engine that classifies task complexity to select the most cost-effective AI model for Openclaw Skills agents.
MoA: Mixture of Agents
A sophisticated reasoning engine that orchestrates a mixture of frontier AI models to debate and synthesize high-quality answers for complex queries.
Ooze Agents
A visual identity and reputation system for AI agents that evolves their digital avatar based on real-world activity and verification.
Slipbot
A sophisticated Zettelkasten-style engine that transforms raw thoughts and research into a structured, bidirectional knowledge graph.
HLE Tunnel
Securely expose your local AI agent UI and services to the web with automatic HTTPS and SSO-based access control.
Secret Manager
A secure utility for managing API keys via the system keyring and injecting them into OpenClaw configurations.
Featured*
