# Mongonaut: Self-Hosted MongoDB Web GUI

## Cloudflare Zero Trust Tunnel

> Category: Security

---

## Pages

- [Overview](https://mongonaut.org/about-mongonaut)
- [Installation](https://mongonaut.org/installation)
- [Docker setup](https://mongonaut.org/mongodb-gui-docker)

### Compare

- [Mongonaut vs mongo-express](https://mongonaut.org/compare/mongonaut-vs-mongo-express)
- [Mongonaut vs MongoDB Compass](https://mongonaut.org/compare/mongonaut-vs-mongodb-compass)

### Guides

- [Migrate from mongo-express](https://mongonaut.org/guides/migrate-from-mongo-express)
- [Read-only configuration](https://mongonaut.org/guides/read-only-configuration)
- [Troubleshooting](https://mongonaut.org/guides/troubleshooting)

### Security

- [Authentication](https://mongonaut.org/security/authentication)
- [Cloudflare Zero Trust Tunnel](https://mongonaut.org/security/zero-trust-tunnel)

### Community

- [FAQ](https://mongonaut.org/community/faq)
- [Contributing](https://mongonaut.org/community/contributing)

---

# Cloudflare Zero Trust Tunnel

This guide shows how to put Mongonaut behind Cloudflare Tunnel and Cloudflare Access. The goal is to avoid publishing a MongoDB admin interface directly to the internet while still allowing browser access for approved users.

Cloudflare Access can be used together with Mongonaut's own authentication. For sensitive environments, keep Mongonaut authentication enabled and use Cloudflare Access as an outer layer.

## Prerequisites

- A Cloudflare account with Zero Trust enabled.
- A domain managed by Cloudflare.
- A server running Mongonaut on a private port, usually `8081`.
- A Cloudflare identity provider or one-time PIN login configured in Zero Trust.
- Optional but recommended: Mongonaut `ACCOUNT`, `STATIC_PASSWORD` or `OIDC` authentication enabled.

## 1. Run Mongonaut locally on the server

Keep Mongonaut bound to the server or Docker network and let Cloudflare Tunnel publish the external hostname.

```yaml name="docker-compose.yml"
services:
  mongo:
    image: mongo:latest
    restart: unless-stopped
    volumes:
      - mongo-data:/data/db
    networks:
      - mongo-network

  mongonaut:
    image: ghcr.io/withzu/mongonaut
    restart: unless-stopped
    environment:
      MONGO_CONNECTION_URL: mongodb://mongo:27017/
      MONGONAUT_AUTH_SECRET: ${MONGONAUT_AUTH_SECRET}
    ports:
      - 127.0.0.1:8081:8081
    depends_on:
      - mongo
    networks:
      - mongo-network

volumes:
  mongo-data:

networks:
  mongo-network:
    driver: bridge
```

This port binding exposes Mongonaut only on the host loopback interface.

## 2. Create a Cloudflare Tunnel

In Cloudflare Zero Trust:

1. Open **Networks > Tunnels**.
2. Create a tunnel for the server running Mongonaut.
3. Install and run `cloudflared` using the command Cloudflare gives you.
4. Confirm that the tunnel reports as healthy.

You can also run `cloudflared` with Docker. Use the token generated in the Cloudflare dashboard:

```yaml name="cloudflared-compose.yml"
services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token ${CLOUDFLARED_TOKEN}
```

## 3. Add a public hostname

In the tunnel settings, add a public hostname for Mongonaut.

```text
Subdomain: mongonaut
Domain: example.com
Service: http://localhost:8081
```

If `cloudflared` runs in a separate Docker container, make sure it can reach the Mongonaut service. You may need to run both containers in the same network and use `http://mongonaut:8081` as the service URL.

## 4. Protect the hostname with Cloudflare Access

Create a self-hosted Access application:

1. Open **Access > Applications**.
2. Add a **Self-hosted** application.
3. Set the application domain, for example `mongonaut.example.com`.
4. Create a policy for the people or groups allowed to access it.
5. Save the application and test sign-in from a private browser window.

Use a policy that matches your organization, such as allowed email addresses, identity provider groups or an access group.

## 5. Keep or configure Mongonaut authentication

Cloudflare Access protects the hostname before traffic reaches Mongonaut. You can still keep Mongonaut account login enabled:

```env name=".env"
MONGONAUT_AUTH_MODE=ACCOUNT
MONGONAUT_AUTH_SECRET=<your signing secret>
```

If you intentionally rely only on Cloudflare Access, make the choice explicit:

```env name=".env"
MONGONAUT_AUTH_MODE=NONE
```

With `NONE`, Cloudflare Access becomes the access boundary. Do not expose the same container through another public route.

## 6. Test access

Check these URLs:

```text
https://mongonaut.example.com/login
https://mongonaut.example.com/setup
```

Expected behavior:

- A new unauthenticated visitor sees the Cloudflare Access login first.
- After Cloudflare Access succeeds, Mongonaut shows `/login` or `/setup` depending on its authentication mode and setup state.
- Direct access to `http://<server-ip>:8081` should not work from the public internet.

## Common errors

### Tunnel is healthy but the page returns 502

The service URL is wrong from the perspective of `cloudflared`. If `cloudflared` runs in Docker, `localhost` points to the `cloudflared` container, not the host. Put both containers in the same network and use `http://mongonaut:8081`, or use host networking where appropriate.

### Access login works but Mongonaut OIDC fails

If Mongonaut also uses OIDC, set `MONGONAUT_OIDC_REDIRECT_URL` to the public callback URL:

```env
MONGONAUT_OIDC_REDIRECT_URL=https://mongonaut.example.com/api/auth/oidc/callback
```

Register the same callback in your identity provider.

### Users can bypass Cloudflare

Do not publish `8081` on a public interface. Prefer `127.0.0.1:8081:8081`, a private firewall rule, or a Docker-only network.

### MongoDB Atlas cannot connect

Cloudflare Tunnel protects HTTP access to Mongonaut. It does not change whether the Mongonaut server can reach MongoDB Atlas. Configure Atlas network access for the server running Mongonaut.

## Related links

- [Install Mongonaut](/installation)
- [Authentication](/security/authentication)
- [Read-only configuration](/guides/read-only-configuration)
- [Troubleshooting](/guides/troubleshooting)