​

ttyd

🗎 Refs: Github Repo

• Quick action

sudo ttyd -s SIGKILL -p 7593 -W bash -x

​

ttyd + Cloudflare Zero Trust + Cloudflare Tunnel

​

Create dedicated user

sudo adduser --gecos "" ttyd
sudo usermod -aG sudo ttyd

​

Install

sudo apt update
sudo apt install -y ttyd tmux zsh git curl wget
sudo chsh -s /usr/bin/zsh ttyd

​

Create per-connection tmux wrapper

#!/usr/bin/env bash
SESSION="web-$(date +%s-%N)"
cd /home/ttyd
exec tmux new-session -A -s "$SESSION" zsh

sudo chmod +x /home/ttyd/start-tmux.sh

​

Add tmux auto-cleanup

set -g destroy-unattached on
set -g detach-on-destroy on

• Restart

sudo systemctl restart ttyd

​

Create systemd service

[Unit]
Description=ttyd - SSH Web Terminal
After=network.target

[Service]
User=ttyd
Group=ttyd
Environment=HOME=/home/ttyd
WorkingDirectory=/home/ttyd
ExecStart=/usr/bin/ttyd -t titleFixed="HostDzire-4-6-100" --port 7529 --writable --check-origin=false \
    /home/ttyd/start-tmux.sh
Restart=always
RestartSec=3

# Security hardening, consider yourself
ProtectHome=read-only
ProtectSystem=full
PrivateTmp=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

• Apply:

sudo systemctl daemon-reload
sudo systemctl enable --now ttyd

• Check:

sudo systemctl status ttyd

🗎 Refs: Cloudflare Tunnel + GAuth

​

Install Cloudflare Tunnel

• Install:

wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared-linux-amd64.deb

• Login:

sudo cloudflared tunnel login

• Create tunnel

sudo cloudflared tunnel create ttyd-tunnel
sudo mkdir -p /etc/cloudflared
sudo cp /root/.cloudflared/*.json /etc/cloudflared/
sudo chown root:root /etc/cloudflared/*.json

• Check cloudflared location & tunnel ID

which cloudflared
cloudflared tunnel list

• Config:

tunnel: TUNNEL_ID
credentials-file: /etc/cloudflared/TUNNEL_ID.json

ingress:
  - hostname: your-subdomain.example.com
    service: http://localhost:7529
  - service: http_status:404

• Install Cloudflare’s official systemd service and enable:

sudo cloudflared service install
sudo systemctl enable --now cloudflared

• Config DNS: Check Cloudflare’s DNS page -> CNAME rule with the target is TUNNEL_ID.cfargotunnel.com

​

Setup Zero Trust

​

Create policy

• Access controls -> Policies -> Add a policy
• Input Policy name, Action as Allow, Session Duration as Same as...
• Add rules Include with Selector is Emails and input whitelisted emails
• Save policy

​

Create App Launcher

• Access controls -> Access settings -> Manage your App Launcher
• Tab Policies -> Select existing policies -> Choose the created policy
• Tab Login methods -> Enable PIN
• Save App Launcher

​

Create App Launcher

• Access controls -> Applications -> Add an application
• Choose Self-hosted, enter Application name, Session Duration
• Add public hostname, input subdomain configured before
• Access policies -> Select existing policies -> Choose the policy created before
• Login methods -> Accept all...

​

Add Google Auth

• Integrations -> Identity providers -> Add an identity provider