Cloudflare Tunnel directly to ESP32-S3 without any intermediary server

[iiot-esp32-brasil]

Hi everyone,

I’m investigating the feasibility of running a Cloudflare Tunnel client directly on an ESP32-S3 using ESP-IDF.

The desired architecture is:

Domain -> Cloudflare -> Tunnel -> ESP32-S3

There would be no intermediary server:

no Raspberry Pi
no Linux machine
no VPS
no Docker
no Nginx
no separate cloudflared host

The ESP32-S3 itself would establish and maintain the outbound tunnel connection to Cloudflare.

The goal is to expose an HTTP/HTTPS service running directly on the ESP32 through a public domain, while keeping the ESP32 behind NAT/firewalls and without opening inbound ports.

Conceptually:

https://device.example.com

↓

Cloudflare Edge

↓

Cloudflare Tunnel

↓

ESP32-S3

↓

ESP-IDF HTTP server

In other words, I’m not looking for the usual architecture where cloudflared runs on a Raspberry Pi or Linux server and then forwards requests to an ESP32 on the local network.

I want the ESP32 itself to behave as the Cloudflare Tunnel endpoint/client.

Has anyone attempted this on ESP32, ESP-IDF, or another constrained embedded device?

I would especially like to understand:

whether this is technically feasible with the networking stack available in ESP-IDF;
whether HTTP/2 or QUIC would be the better transport;
memory/RAM requirements for maintaining the persistent tunnel;
TLS and multiplexing limitations;
whether there are existing components that could help implement the Cloudflare Tunnel protocol directly on the ESP32-S3.

Thanks!

[david-cermak]

Hi @iiot-esp32-brasil

Here's a personal project that should work, but is not production ready: https://github.com/david-cermak/cloudflared
Start with running the tunnel-app on your ESP32, it will display a QR code in the log (stdout/uart) of a cloudflare temp endpoint which you can connect to and it'll bring you to the http server running on the ESP32 (which will just say: https://github.com/david-cermak/cloudflared/blob/02e8e9645feb902c6a675987230fa07be5051fe3/tunnel-app/main/http_proxy_static.c#L19-L22)

The project is using this quic impl: https://github.com/david-cermak/picoquic (also my personal project, not backed by espressif, so don't expect too much:)