MiningOps Get a license
Menu

Guides

Install MiningOps behind a Cloudflare Tunnel

Cloudflare Tunnel runs a small program, cloudflared, on your server. It connects out to Cloudflare, and Cloudflare sends your visitors and rigs back down that connection. Nothing on the internet can reach your server directly: no open ports, no public IP address, and it works behind a home router too.

You'll need

  • A server or virtual machine running Ubuntu 24.04 that stays on, with internet access. It needs to reach Cloudflare on port 7844, which most networks allow.
  • A domain whose DNS is on Cloudflare. The free plan is enough.
  • Your license key. Don't have one yet? Get a license.
  • About 20 minutes. Our examples use mining.example.com: use your own name instead.

  1. Install MiningOps in tunnel mode

    On the server, run the installer with --tunnel. It installs the site and has it listen on 127.0.0.1:3800, which only programs on the server itself can reach. It opens nothing in the firewall.

    curl -fsSL https://miningops.io/install.sh | sudo bash -s -- --key YOUR-KEY --domain mining.example.com --tunnel 3800

    Use your full license key in place of YOUR-KEY, and the address you want for the site in place of mining.example.com. When it finishes, the installer prints a setup key for your first sign-in. Keep it for step 4.

  2. Create the tunnel

    1. Sign in to the Cloudflare dashboard and go to Networking → Tunnels.
    2. Select Create a tunnel, name it, for example miningops, and select Create Tunnel.
    3. Choose your server's system (Debian covers Ubuntu) and copy the install command Cloudflare shows.
    4. Run that command on the MiningOps server. It installs cloudflared and connects it to your tunnel.
    5. Wait until the dashboard shows the tunnel connected, then select Continue.
    The command holds your tunnel's token. Anyone with it can run your tunnel, so don't paste it anywhere public.

    Cloudflare moves its menus now and then. If yours look different, search the dashboard for Tunnels.

  3. Send your domain to MiningOps

    In the tunnel, open Routes, select Add route, then Published application:

    • Subdomain: mining, and Domain: your domain.
    • Service URL: http://localhost:3800, the same port you gave the installer.

    Select Add route. Cloudflare creates the DNS record for you.

    Use http here, not https: the tunnel carries the traffic encrypted, and Cloudflare serves your visitors HTTPS. Keep to one level of subdomain, like mining.example.com: deeper names need a paid certificate from Cloudflare.

  4. Create your admin account

    Open https://mining.example.com and create your admin account with the setup key from step 1. If you've lost it, read it on the server:

    sudo cat /opt/miningops/miningops-private/install-key.txt

    The setup key works only until the first admin account exists.

  5. Close the server to the internet

    Everything now reaches MiningOps through the tunnel, so the server can refuse every incoming connection except SSH, which you use to manage it:

    sudo ufw allow OpenSSH && sudo ufw enable
    Allow SSH before you turn the firewall on, or you lock yourself out of a remote server. If you only manage the server from your own network, you can limit SSH to it.

  6. Check two Cloudflare settings

    • SSL/TLS → Edge Certificates: turn on Always Use HTTPS, so anyone who types http:// is sent to the secure address.
    • Security → Bots: leave Bot Fight Mode off, and don't use I'm Under Attack mode for this domain. Both challenge anything that isn't a web browser, and your rigs' agents can't answer a challenge. On Cloudflare's free plan, Bot Fight Mode can't be switched off for single addresses.

Optional: Cloudflare Access in front of the dashboard

MiningOps has its own sign-in, which locks out repeated wrong passwords for a while. For a second lock, you can put Cloudflare Access in front of the site, so only email addresses you allow even see the sign-in page.

If you do, add a Bypass for the addresses your rigs use, because a rig's agent can't sign in to Access. Each rig proves who it is with its own token instead:

  • https://mining.example.com/api.php, where rigs report and collect their commands
  • https://mining.example.com/miningops-agent*, where they download the agent and its updates

If something doesn't work

  • Cloudflare shows error 1033 or 502. The tunnel isn't connected, or it can't reach the site. On the server, check both services, and that the route's Service URL is http://localhost:3800:
sudo systemctl status cloudflared miningops
  • Rigs stay on "Waiting for agent". Check Bot Fight Mode and I'm Under Attack mode first, then the Access bypass if you use one. From a rig, this should print a line starting with {"ok":true:
curl -s https://mining.example.com/health

Updating MiningOps later doesn't touch the tunnel: install new releases from Settings → Updates as usual.