What this is about
A custom action calls your system from the internet via https. Paldra cannot reach addresses in the company network (e.g. http://192.168.1.20:8080) – and must not: we always reject private addresses. The solution is a tunnel: a small program in your network opens an outbound connection to a provider and makes exactly one service reachable under a public https address. You don't need to open anything in the firewall.
Cloudflare Tunnel (recommended)
Requirements: a free Cloudflare account and a domain whose DNS is on Cloudflare (e.g. yourcompany.com), plus a machine in the company network that can reach your system (server, VM or Raspberry Pi; Linux, Windows or macOS).
alpheris.cloudflared then runs as a service and starts by itself after a reboot.erp-api, domain yourcompany.com, path only what is needed (e.g. ^/api/alpheris/.*), service HTTP and the internal address, e.g. 192.168.1.20:8080.erp-api.yourcompany.com with a rule, action Service Auth, that allows exactly this token.https://erp-api.yourcompany.com/api/alpheris/… and add two headers under “More: headers …”: CF-Access-Client-Id and CF-Access-Client-Secret with the values from step 4.Prefer a configuration file over the dashboard? Then like this:
cloudflared tunnel login
cloudflared tunnel create alpheris
cloudflared tunnel route dns alpheris erp-api.yourcompany.com
sudo cloudflared --config /etc/cloudflared/config.yml service install# /etc/cloudflared/config.yml
tunnel: alpheris
credentials-file: /etc/cloudflared/<TUNNEL-ID>.json
ingress:
- hostname: erp-api.yourcompany.com
path: ^/api/alpheris/
service: http://192.168.1.20:8080
- service: http_status:404Check from outside (without the token Cloudflare must reject, with the token your system answers):
curl -i https://erp-api.yourcompany.com/api/alpheris/status
curl -i https://erp-api.yourcompany.com/api/alpheris/status \
-H "CF-Access-Client-Id: <ID>.access" -H "CF-Access-Client-Secret: <SECRET>"Security: what to watch out for
- Publish only what is needed: a separate path or a small service just for Paldra – never the whole admin interface.
- Two locks: Cloudflare Access (service token) in front of the tunnel and check the signature of every call (
X-Alpheris-Signature, see verifying calls). Reject calls without a valid signature. - A dedicated user with few permissions in the internal system: read wherever possible; writing actions (PUT, PATCH, DELETE) with the stage “customer confirms” or “draft”.
- Personal data only for the matching customer: use the confirmed email (
X-Alpheris-Customer-Email) and return only that customer’s data. - Rotate secrets: service token and signing secret can be renewed at any time; enter them in Paldra again afterwards.
- Logs: Cloudflare shows every access under Zero Trust → Logs; your system should record the
X-Alpheris-Request-Id.
Other ways
- Tailscale Funnel:
tailscale funnel 8080makes a service reachable athttps://<machine>.<tailnet>.ts.net. There is no access protection in front – so always check the signature and add your own key as a header. - ngrok with a fixed domain:
ngrok http --url=erp-api.yourcompany.com 8080; secure access with your own header (e.g.X-Api-Key) or ngrok’s policies. - Reverse proxy in the DMZ (nginx, Caddy, Traefik) with a valid certificate and a key header – if your IT runs one anyway.
- Only data, no live access needed? Then a lookup table (CSV/Excel or published link) or
POST /v1/wissenfrom your system is often enough – no tunnel required.
IP allowlisting
We currently don't publish fixed outbound IP addresses. They can change when servers are expanded or moved, so allowing access by IP address alone is not reliable. IP allowlisting on request – contact us via support. A service token or key header plus the signature of every call is safer and permanent.