How to setup E2E Encryption for Immich Remote Access with Cloudflare Tunnel reddit / selfhosted ---------------------------------------------------------------------- aviv926 · 2023-11-19 19:15 **I'm sure I'll find the answer to my question here. It's been asked a few times, but there hasn't been a definitive answer. Everywhere, something else is said (**[\#](https://www.reddit.com/r/selfhosted/com ments/yrr0da/comment/ivxs240)**).** **I want to set up remote access to Immich (a Docker image hosting service) using Cloudflare Tunnel. The problem is that by default, Cloudflare can see all the data that goes through the tunnel. To do this, I want to use TLS with self-signed certificates through Let's Encrypt.** **In this way, I can keep the data fully encrypted between the client and the server, in the following way:** **client-->tls-->tunnel-->tls-->server. Then all traffic going through the tunnel would not be viewable.** **Is this configuration really possible so that Cloudflare won't be able to see my data? How can I make this entire configuration work at its best?** ---------------------------------------------------------------------- adamshand · 2023-11-19 19:37 I think you are misunderstanding a couple things. - E2E encryption means that data is encrypted in such a way that not even the administrator of the server/network can see the data. This requires application support and is not something a network provider (like Cloudflare) can provide. - Clouldflare provides their services by decrypting SSL/TLS traffic and then re-encrypting it and forwarding it to your service. There is no way around this. ---------------------------------------------------------------------- crayiii · 2023-11-19 19:57 Have you looked into using Tailscale for this? ---------------------------------------------------------------------- aviv926 · 2023-11-19 20:17 * Yes, actually I meant TLS encryption by mistake in the E2E header * Even if I use certificates through Let's Encrypt, it still won't prevent cloudflare tunnel from seeing the traffic? After all, the private key of the certificates is on the server side and on the client side And the public key is on cloudflare's server if so how will they be able to decrypt it? There are opinions on both sides, but I haven't found anyone who can provide a clear opinion on this issue I would appreciate it if you could help me with this ---------------------------------------------------------------------- aviv926 · 2023-11-19 20:18 It's a very good solution, the problem is that it's not good for me because I need it for my family and they don't have that much experience and desire to mess with complicated settings (unfortunately) ---------------------------------------------------------------------- schklom · 2023-11-19 20:20 > Even if I use certificates through Let's Encrypt, it still won't prevent cloudflare tunnel from seeing the traffic? Try it, then check if the certificates on your website come from Let's Encrypt or Cloudflare. They will most likely come from Cloudflare, meaning CF decrypts everything. ---------------------------------------------------------------------- adamshand · 2023-11-19 21:43 Use a client to connect to one of your services via Cloudflare. Inspect the certificate, it will be a Cloudflare certificate (not the Let's Encrypt cert issued to your service). ---------------------------------------------------------------------- adamshand · 2023-11-19 21:47 If you want to provide services to non-technical people, and you want to make sure that no one can peek along the way, you need to own every server that handles the data. You have two basic options: - Expose your service ports directly to the internet and secure them using a Let's Encrypt (or similar) certificate. - If you can't (or don't want to) expose your service directly to the internet, install some sort of proxy on a VPS that you control which routes traffic to your service. Boring proxy, Wireguard, or Caddy/Traefik/Nginx are all ways to do this. ---------------------------------------------------------------------- cfarence · 2023-11-19 21:53 Zero trust doesn’t change that. There is some enterprise features in general that let you bring your own cert and even have control of the private keys that is used in cloudflares edge. However pricing makes those out of reach for the home user. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-20 09:36 * Get a cheap VPS. * Get a domain name and point its `A` record to the IP of the VPS. * Set up a VPN tunnel between the VPS and your home server. You can use Tailscale or wg-easy. You don't need to worry about CGNAT because you're establishing the VPN by going *out* of your server (either through Tailscale or to the VPS IP with wireguard). * Port-forward 443 on the VPS public IP through the tunnel to a reverse proxy running on the home server (NPM, Caddy, Traefik etc.) * Get a Let's Encrypt wildcard TLS certificate for *.yourdomain.tld. * Set up the reverse proxy to use the TLS certificate for immich.yourdomain.tld and point it at your immich container. ---------------------------------------------------------------------- aviv926 · 2023-11-25 17:14 Wow, thank you for the response, I'll try to check it out, it seems like a complicated process for someone who just started with the whole self-hosting world. But thank you very much for the response! ---------------------------------------------------------------------- aviv926 · 2023-11-25 17:18 Thanks for your response, I haven't been online lately so now I'm just seeing the comments In fact if I was able to get the client to see Let's Encrypt does that mean Cloudflare has no way to decrypt the information? Plus I just want to deva to use cloudflare tunnel i have to buy my own domain right? ---------------------------------------------------------------------- adamshand · 2023-11-25 19:49 If you are seeing your servers Let's Encrypt certificate in the browser then: - Yes, network traffic is encrypted between your server and your browser. - You are bypassing Cloudflare (the way CF works is to intercept and decrypt your traffic and the above will never be true).