Public tunnels

A Cloudflare quick tunnel gives a local site a public HTTPS URL — for a client review, a webhook that needs to reach you, or testing on a real phone.

rex tunnel start myshop.rex     # prints the public URL
rex tunnel list
rex tunnel stop myshop.rex

How it works

cloudflared makes an outbound connection to Cloudflare and receives requests over it. Nothing listens on your machine, no port is opened, and no router configuration is involved — which is also why it works behind NAT and on a café network.

WordPress URL rewriting

WordPress writes its own URL into the database and into generated markup, so a site reached at a tunnel URL would otherwise serve links pointing back at https://myshop.rex — which resolves to nothing on your client’s machine.

rexenv rewrites for the tunnel while it is up, so shared links work.

Tunnels die with the app

Deliberate, and the safest default

Quitting rexenv closes any open tunnel. Unlike the rest of the stack — which outlives the app on purpose — a tunnel does not survive.

A public URL serving your development machine, still up because you forgot about it, is not a convenience. A share you have forgotten is a share you did not consent to.

If rexenv crashes with a tunnel open, the next launch cleans it up.

What a tunnel exposes

The site, as it is, to anyone with the URL. Quick tunnel URLs are unguessable but not secret — they are not access control.

Do not tunnel a site holding real customer data, real credentials, or an unprotected admin account with a weak password. Local sites are usually configured far more loosely than production, and a tunnel makes that configuration reachable.

When it will not start

The tunnel needs the site to be serving locally first. rex status for the stack, rex doctor if something looks wrong. A failed tunnel names its reason rather than reporting a generic error.