Properties3
| Type | Practice |
| Note created | Mar 10, 2026 |
| Last updated | Mar 11, 2026 |
This documents the setup for exposing OpenCode Web on chaika.diego.codes from a local macOS machine, using a Cloudflare Tunnel secured with Cloudflare Access (GitHub OAuth) and HTTP basic auth. The general tunnel setup is covered in Exposing a Local Server via Cloudflare Tunnel.
OpenCode Web
OpenCode has a web command that serves the UI over HTTP. I set it with no user or password since the authentication is delegated to Cloudflare’s Zero Trust access. The tunnel is named chaika and routes chaika.diego.codes to http://localhost:4096. The configuration lives at ~/.cloudflared/config.yml. The technical details on how to set it can be seen in this note.
Running as a service
The tunnel runs as a macOS Launch Agent. The plist installed by cloudflared service install needs to be edited to include the tunnel run arguments, since it only installs the bare binary by default. Use launchctl to stop and start the service every time the configuration changes.
Logs are at:
~/Library/Logs/com.cloudflare.cloudflared.out.log~/Library/Logs/com.cloudflare.cloudflared.err.log
Security considerations
OpenCode Web exposes the full filesystem through its HTTP APIs and web UI (as of 2026-03-10), regardless of the permission config — permissions only gate LLM tool calls, not the direct REST endpoints. The authentication layer via Clouflare does mitigate this, but the only way to truly sandbox filesystem access is to run OpenCode inside a Docker container with a volume mount restricted to the desired directory.