Cloudflare SSH Access

Purpose

Git operations against the self-hosted GitLab service are exposed through Cloudflare Access instead of direct public SSH. The VPS runs cloudflared, Cloudflare enforces authentication and authorization, and the local workstation uses an SSH ProxyCommand.

Note

This model keeps GitLab SSH private by default. The public hostname is an identity-aware entrypoint, not an unrestricted bridge to the VPS or the homelab.

Access Flow

sequenceDiagram
  participant Workstation as Developer workstation
  participant ProxyCommand as SSH ProxyCommand
  participant Edge as Cloudflare Edge
  participant Access as Cloudflare Access
  participant Tunnel as Cloudflare Tunnel
  participant Agent as cloudflared on VPS
  participant SSHD as VPS SSHD
  participant GitLab as GitLab Shell

  Workstation->>+SSHD: git push to git@ssh-gitlab.yourbox.site
  Workstation->>+ProxyCommand: ~/.ssh/config invokes cloudflared access ssh
  ProxyCommand->>+Edge: Open SSH session for ssh-gitlab.yourbox.site
  Edge->>+Access: Evaluate identity and access policy
  Access-->>Workstation: Authenticate user or service token
  Workstation->>Access: Complete authentication challenge
  Access-->>Edge: Access granted
  Edge->>+Tunnel: Route SSH traffic through tunnel
  Tunnel->>+Agent: Forward SSH session
  Agent->>+SSHD: Relay to localhost:22
  SSHD-->>Workstation: SSH key authentication challenge
  Workstation->>SSHD: SSH key authentication response
  SSHD->>+GitLab: Execute authorized Git command
  GitLab-->>-SSHD: Git command result
  SSHD-->>-Agent: Close SSH session
  Agent-->>-Tunnel: Tunnel response
  Tunnel-->>-Edge: Cloudflare response
  Edge-->>-Workstation: Git client response

Operational Checks

1. Confirm the Cloudflare Access policy requires an approved identity or service token.

2. Confirm cloudflared is healthy on the VPS and exposes only the intended SSH hostname.

3. Confirm the SSH server still enforces key authentication.
4. Review GitLab audit events after privileged Git operations.

Failure Modes

Symptom	Likely Cause	First Check
Browser authentication appears	Access policy requires user approval	Cloudflare Access logs
SSH hangs before key exchange	Tunnel or cloudflared is unhealthy	cloudflared service status on VPS
SSH key is rejected	GitLab SSH key or Unix account issue	GitLab user keys and SSHD logs
CI cannot push	Missing or expired service token	CI secret scope and token lifetime