The Problem: The “Cloud-to-Local” Gap

If you’ve explored Tines Community Edition (CE), you know it’s one of the most powerful SOAR (Security Orchestration, Automation, and Response) platforms available. However, a common hurdle for home lab enthusiasts is connectivity. While the hosted cloud version is free, connecting it to your private infrastructure (like a Proxmox cluster or local NAS) usually requires an expensive paid plan to unlock secure network tunnels.

Most users default to opening ports on their router and using Dynamic DNS (DDNS). This is a security nightmare. We need a way to bridge Tines Cloud to a Local Lab that is:

1. Secure (No open inbound ports).
2. Authenticated (Only Tines can talk to it).
3. Completely Free.

How Do Cloudflare Tunnels Solve the Cloud-to-Local Gap?

Cloudflare Tunnels (formerly Argo Tunnel) create an encrypted, outbound-only connection between your local environment and the Cloudflare edge. By placing our local API (Application Programming Interface) behind a tunnel, we can expose it via a public hostname that only accepts traffic from specific sources—in this case, Tines.

What Does the Traffic Flow Architecture Look Like?

The traffic flow looks like this:

1. Tines Cloud sends an HTTP (HyperText Transfer Protocol) Request to your public hostname (e.g., proxmox.yourdomain.com).
2. Cloudflare WAF (Web Application Firewall) intercepts the request and verifies the source IP.
3. If the IP matches Tines, the request is passed through the Cloudflare Tunnel.
4. The Cloudflared agent running in your lab receives the request and forwards it to your local Proxmox IP.

---

How Do You Deploy the Cloudflare Tunnel?

First, install the cloudflared agent on a small Linux VM (Virtual Machine) or container in your lab.

# Example for Debian/Ubuntu
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

# Authenticate and create your tunnel
cloudflared tunnel login
cloudflared tunnel create homelab-automation

In the Cloudflare Zero Trust dashboard, point your hostname (e.g., tines-api.yourdomain.com) to the local service (e.g., https://192.168.1.50:8006).

How Do You Lock Down the WAF?

Exposing your Proxmox API to the internet is dangerous. We must ensure only Tines can reach this tunnel.

Go to Security > WAF in Cloudflare and create a “Custom Rule”:

• Field: IP Source Address
• Operator: is in
• Values:
  • 44.246.174.5
  • 54.70.210.130
• Action: Allow

Then, create a second rule that Blocks all other traffic to that specific hostname.

How Do You Configure Tines?

In your Tines storyboard, create an HTTP Request Action:

• URL: https://tines-api.yourdomain.com/api2/json/nodes
• Method: GET
• Headers: Add your Authorization or PVEAPIToken header.

Because the request originates from Tines’ dedicated egress IPs, Cloudflare will permit the traffic, and your tunnel will securely deliver it to your local Proxmox node.

---

Why Does This Setup Give You Total Control for $0?

This setup bypasses the connectivity limitations of Tines CE and provides a professional-grade integration for your home lab. You now have the power of cloud-native automation with the security of an outbound-only private tunnel.

Project Resources:

• Official GitHub Repository
• Tines Documentation
• Cloudflare Tunnel Guide

Recommended Reading

• Automating IOC Management with Tines + Infoblox Threat Defense — another practical Tines automation that pairs well with a home lab tunnel setup.
• Introducing MCP Servers in Tines — My Hands-On Guide — if you want to go further and connect Tines to AI agents rather than just APIs.
• Rolling your own SYSLOG and fake SIEM — another free, self-hosted home lab project that pairs with this Cloudflare Tunnel setup.

Frequently Asked Questions

What are Tines’ egress IP addresses for allowlisting? Tines Cloud’s egress IPs are 44.246.174.5 and 54.70.210.130. Allowlist only these two addresses in your Cloudflare WAF custom rule, and block all other traffic to the tunneled hostname.

Do I need a paid Tines plan to use Cloudflare Tunnels? No. This setup works with Tines Community Edition (CE), which is free. Cloudflare Tunnels replace the paid, built-in network tunnel feature that otherwise requires an upgraded Tines plan.

Is opening a port on my router a viable alternative to a Cloudflare Tunnel? No. Opening inbound ports and relying on Dynamic DNS (DDNS) exposes your local services directly to the internet, which is a security risk. A Cloudflare Tunnel makes only an outbound connection from your lab, so there are no open inbound ports to attack.

Can I use this same setup to connect Tines to other local services besides Proxmox? Yes. The pattern is generic: point cloudflared at any local service (a NAS, an internal API, a home automation hub), lock the WAF rule down to Tines’ egress IPs, and reference the resulting public hostname in your Tines HTTP Request action.

Do I need a domain name to set this up? Yes, you need a domain onboarded to Cloudflare so you can create a public hostname (like tines-api.yourdomain.com) that routes through the tunnel. The domain does not need to be used for anything else.