Cloudflare Integration

1. Navigate to Networks > Connectors.
2. Select Cloudflared.
3. Create a new tunnel with the following name format: [client]-tunnel-[environment].
4. Click Save tunnel.
5. Important: Save the generated token and share it with Lumia Security along with the selected tunnel name.
6. Click Next.
7. Under the CIDR tab, add 172.20.0.0/16.

1. Navigate to Access controls > Applications.
2. Click Add Application.
3. Select Self-Hosted application.
4. Configure the following settings:
• Name: [Client] Security Access App
• Session duration: Set according to your organization's security requirements.
5. Click Add private hostname and enter the following details:
• Hostname: 172.20.0.0/16
• Port: 443
6. Click Next, click Next again, and then click Save.

1. Navigate back to Access controls > Applications and select the application you just created.
2. Go to the Advanced settings tab.
3. Verify and configure the following:
• CORS Settings: Toggle Bypass options requests to origin to ON (enabled).
• Service Auth Behavior: Toggle Return 401 Response to OFF (disabled).
• Authentication Support: Toggle Authenticate with Cloudflare One Client to ON (enabled).

• Your Cloudflare API Token with Zero Trust: Editpermissions.
• Lumia Tenant UUID (provided by Lumia).
• Account ID

curl https://downloads.lumiasecurity.com/feed/<Tenant_UUID>/domains.list > domains.list

curl -X POST "https://api.cloudflare.com/client/v4/accounts/<account_id>/gateway/lists" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "LUMIA_HOSTS",
    "type": "DOMAIN",
    "description": "Managed via API"
  }'

{
  "result": {
    "id": "b3c66255-85bf-425f-8f10-32f8abbc296c", # <--  use this in the next call
    "name": "LUMIA_HOSTS-1",
    "description": "Lumia Hosts",
    "type": "DOMAIN",
    "created_at": "2025-12-31T15:58:06Z",
    "updated_at": "2025-12-31T15:58:06Z"
  },
  "success": true,
  "errors": [],
  "messages": []
}

curl -X PUT "https://api.cloudflare.com/client/v4/accounts/<account_id>/gateway/lists/<list_id>" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <token>" \
  --data-binary "@domains.list"

{
  "result": {
    "id": "2aea1f29-f829-4e17-9063-f99056365f12",
    "name": "LUMIA_HOSTS",
    "description": "Lumia Hosts",
    "type": "DOMAIN",
    "created_at": "2025-12-31T15:40:04Z",
    "updated_at": "2025-12-31T15:42:25Z",
    "count": 826
  },
  "success": true,
  "errors": [],
  "messages": []
}

1. Navigate to Traffic policies > Firewall policies.
2. Select the DNS tab and click Add a policy.
3. Step 1 (Name): Enter the name Lumia Host Override Policy.
4. Step 2 (Traffic): Set the following conditions:
• Selector: Domain
• Operator: in list
• Value: Select the LUMIA_HOSTS list.
5. Step 3 (Identity): (Optional) If deployment is restricted to specific users, list them here. Otherwise, leave blank.
6. Step 4 (Action): Configure the action:
• Action: Override
• Override Hostname: 172.20.0.242
7. Click Save policy.

1. Navigate to Traffic policies > Firewall policies and select the HTTP tab.
2. Click Add a policy.
3. Step 1 (Name): Enter the name Allow no-TLS Validation for Access App.
4. Step 2 (Traffic): Set the following conditions:
• Selector: Self-hosted Access App with Private Address
• Operator: is
• Value: Present
5. Step 3 (Identity): (Optional) If deployment is restricted to specific users, list them here. Otherwise, leave blank.
6. Step 4 (Action): Configure the action:
• Action: Allow
• Untrusted certificate action: Pass Through
7. Step 5 (Headers): Click Add a header and enter:
• Custom header name: Ls-Tenant
• Custom header value: Your <Tenant_UUID> supplied by Lumia Security.
8. Click Save policy.