Expose your services without opening a single port
The secure tunnel powered by cloudflared, installed and monitored by DINAO. Your servers remain closed and invisible on the inbound side — the connection originates from your infrastructure to the Cloudflare network.
What is cloudflared?
cloudflared is the command-line client for Cloudflare Tunnel: a tunneling daemon that relays traffic from the Cloudflare network to your origin servers. Its principle reverses traditional network exposure: instead of opening ports on your firewall or publishing a public IP, the daemon establishes an encrypted and persistent outbound connection to Cloudflare's global network. Your origin can thus remain "as closed as possible".
In practice, cloudflared allows you to securely publish an internally hosted service (website, API, application) on the Internet, without touching the router configuration or exposing the server directly. This eliminates a whole class of risks — port scanning, direct attacks on the origin IP — and integrates natively with Cloudflare's WAF, anti-DDoS, and TLS protections.
The tool goes beyond simple HTTP proxying: via cloudflared access, it reaches origins protected by layer 4 traffic (SSH, RDP, and other TCP streams), in a Zero Trust logic. It is a cornerstone of the Cloudflare One offering for connecting private infrastructure without a traditional VPN.
On the technical side, cloudflared is written in Go and distributed as a standalone binary, Docker image, and packages. Its memory footprint is very low and it requires no database. DINAO deploys it as a container on your French infrastructure, configures the ingress rules, and monitors the tunnel continuously.
Host cloudflared at DINAO
Resource tiers compatible with cloudflared prerequisites (minimum 0,25 vCPU / 64 Mo / 50 Mo). Hosted in France, fully managed.
This application is temporarily unavailable to order: our latest deployment test did not succeed and we are fixing it before offering it again. If you are interested, write to us and we will tell you as soon as it can be ordered again.
Contact usManaged cloudflared hosting in France
Self-hosting cloudflared means a server to maintain, security updates, backups and monitoring. With our managed cloudflared hosting, you use the application: we run the infrastructure.
- Deployed in minutes, always kept up to date
- Daily backups included
- Continuous monitoring, data hosted in France (GDPR)
- Prefer self-hosted with root access? cloudflared also runs on our Docker VPS.
Technical details
You might be wondering…
About cloudflared 6 questions
Do I need to open ports on my firewall?
No, that's the whole point: the connection is outbound only. No inbound ports to open, your server remains closed and invisible.
Does Cloudflared expose my origin IP?
No. The origin remains hidden behind the Cloudflare network, which eliminates port scanning and direct attacks on the IP.
Can you tunnel anything other than HTTP?
Yes: SSH, RDP, and other TCP streams via cloudflared access (layer 4), in a Zero Trust logic, without a classic VPN.
Does the traffic transit through Cloudflare?
Yes. The tunnel connects your origin — hosted in France and monitored by DINAO — to the Cloudflare network, which provides WAF and anti-DDoS. Note that in a sovereignty context: traffic termination depends on the Cloudflare network (a US entity).
Does DINAO handle installation and updates?
Yes. DINAO installs the daemon as a container, configures ingress rules, applies updates, and monitors the tunnel continuously with alerts in case of outage.
Is this application tested before it is offered?
This application has not yet passed our automatic deployment test. It can still be installed, but we invite you to contact us before ordering: we will then test it as a priority. The deployment template used was last updated on 3 July 2026. Each new version released by the publisher triggers this test again: the date above therefore follows the version actually offered.
Option 1 Managed container 15 questions
These answers apply to the managed container. They do not apply to the VPS offers.
What exactly does the managed service cover?
DINAO's managed service is included in the price of your container. It covers the technical operation of the server and its software layers: operating system, database, runtime environment and application (installation, security updates, backups, monitoring). It does not include help with the day-to-day use of the application, which remains the customer's responsibility. It is provided on a best-effort basis, under an obligation of means: your requests are handled according to their nature and criticality, in the order of priority set by DINAO, taking particular account of the impact on service availability. No response or restoration time is guaranteed at this level. Technical monitoring is automatic, 24 hours a day, 7 days a week: an outage is detected without any action on your part. Human interventions take place Monday to Friday, excluding public holidays.
If your business needs a guaranteed response time, two “Support responsiveness” options can be taken out when ordering or during the contract:
– Priority handling (€15 excl. VAT/month): handling by a technician within 2 hours (guaranteed intervention time, GTI);
– Enhanced priority handling (€35 excl. VAT/month): handling within 30 minutes and restoration within 4 hours (GTI and guaranteed restoration time, GTR).
These times are counted only from 9 a.m. to 5 p.m., Monday to Friday, excluding public holidays. Time not elapsed at 5 p.m. resumes on the next working day: with a 2-hour GTI, a request received at 4:30 p.m. is handled at the latest at 10:30 a.m. on the next working day. The GTI guarantees the start of handling, not the resolution. For extended backup retention or a copy on a second site, contact our Application Container department.
How are application updates handled?
Major version upgrades are not included in managed services: they modify the application itself — data schema, extensions, configuration — and may render it inoperable. DINAO, however, offers a protected automatic update option: a full backup is taken, the new version is installed, and then the service startup is automatically verified. If the service does not restart correctly, the previous version and the backup are automatically restored — your application returns to its previous state. This option covers updates within your major version; moving to a higher major version remains your decision and may be subject to a support service.
If I change my application's address, does the old address continue to work?
Yes, for 24 hours: the old address automatically redirects (302, path preserved) to the new one, and then the redirect is removed. Before saving, the dashboard checks that the new address points to the container's server and indicates the DNS record to create if not; the client can also make the www variant respond. The HTTPS certificate is obtained automatically.
Do you provide on-call support outside of business hours?
Not contractually: automatic 24/7 monitoring, with human intervention on working days; out-of-hours intervention remains possible without commitment.
Is there a more committed managed services option than the one included?
Yes, upon request. The included managed services are provided on a "best effort" basis with no guaranteed response time. Extended managed services packages can be set up — including priority handling, extended intervention windows, time commitments, extended backup retention, and replication to a second site. Their content and pricing are determined on a case-by-case basis with the client: as of today, there is no public catalogue of packages or online-purchasable options. Requests should be submitted via the Application Container service (Support Department #12, conteneur@dinao.com).
What is the maximum data loss (RPO) and recovery time objective (RTO) for a container?
Daily backup: at worst, the previous day's data (up to 24 hours). Restoration initiated by the client from their client area, with no time commitment (depends on the volume).
Can I get priority handling for my support requests?
Yes, the "Support Responsiveness" option can be ordered on all four container plans, with three levels: "Best effort" (included, €0, no guaranteed response time), "Priority handling" (€15/month or €150/year) and "Priority handling + extended 8am-8pm window" (€35/month or €350/year). Priority is understood relative to requests from lower-tier customers: none of these levels include a guarantee of response time (RT) or resolution time (RT). Backup retention and off-site copy options are not yet available for ordering.
Can I start on the DINAO subdomain offered at the time of order, then switch to my own domain name later without reinstalling or losing my data?
Yes, at no cost. The "Domain" button in the client area replaces the container's address: the panel first checks that the new name points to the server (and indicates the DNS record to create if not), the HTTPS certificate is obtained automatically, the public address is passed to the application (PUBLIC_URL) and only the application container restarts — database, volumes and settings remain in place. The old address redirects to the new one for 24 hours, the www variant can be added. Moodle: files inserted by the editor follow; manually entered absolute links are updated with the "Find and Replace" tool.
In which data centre is my service hosted?
In France, in DINAO's private racks within two third-party data centres: Free Pro in Marseille (MAR02) and Euclyde DC1 in Sophia-Antipolis. The operator provides the building, power, cooling and physical security; DINAO operates everything inside its racks, entirely and independently.
I want to go directly from my version to the latest one, but an intermediate version changes what the application expects: what happens?
You can upgrade directly; the platform does not block you. Before launching the update, it shows you each breaking change encountered along the way (a mandatory variable to fill in, a data volume that is no longer read, a removed service, a new major version) and what needs to be done. A variable that is already filled in is indicated as done. You confirm once the changes are made; a backup is taken before the update, and if the new version does not start, the service automatically reverts to your previous version. The automatic update, however, never crosses such a change.
I receive the message 'automatic update blocked by security scan': what should I do?
Nothing is mandatory. Before each automatic update, the platform analyzes the new version; with the default setting, it never installs a version that has more vulnerabilities than the one currently in service. The current version continues to operate, backed up daily; the update will proceed automatically as soon as a published version is not less secure. The setting can be changed in the Security tab of the dashboard, with full awareness.
Can DINAO or an artificial intelligence tool access the data in my container?
DINAO does not administer the inside of the container and does not access application data, except upon explicit request from the customer as part of support (Containers conditions, art. 2); access is limited to those who need it and is logged (personal data appendix, §3). AI tools serve as aids for diagnosing incidents (logs, incident correlation, intervention proposals), always validated by an operator. When customer data is involved, models executed on DINAO's computing servers, located in France, take priority; a third-party provider receives only pseudonymised data (names, company names, addresses, phone numbers, domains replaced), does not use it to train its models, and limits its retention (Terms and Conditions, art. 5 bis). Data is never used to train a model. Upon request, DINAO indicates whether an AI was used for a request.
Are there any activation fees or mandatory options in addition to the container price?
No. The four plans (Discovery €9.90, Standard €19.90, Performance €39.90, Intensive €79.90 excl. VAT per month, with 20% VAT added) have no setup fees. The price includes hosting, infrastructure management, the application database, the HTTPS certificate, and daily backups. Options (support responsiveness, backups on request) are optional.
Can I host multiple applications on the same server so they can communicate with each other?
Yes: a private network can connect several of your applications, not just two, provided they are hosted on the same server (otherwise, a prior migration brings them closer). Each exposes the service of your choice under an internal name; you can add, remove, or dissolve the network at any time. If you want to freely assemble many containers with your own networks, a dedicated server (VPS) remains the suitable offering.
Can I choose the datacenter for my container?
Yes, at the time of order: no choice is made on your behalf. The datacenter is then displayed in your client area, in the service information.