Zero Trust access, configured correctly the first time.

Standing up a Cloudflare One stack means a tunnel, an Access policy, an Access app, a DNS record, and a few Gateway rules. The pieces are simple. Getting the syntax right is not.

ZTNA Kit turns a short form into ready-to-run Terraform and API scaffolding, with the version traps and escaping quirks already handled. It never asks for your API token.

Open the configurator No sign-in. No token. Nothing leaves your browser.

The problem

The capability was never missing. The time goes somewhere else.

Version drift

Provider v4 and v5 examples sit side by side with no signpost. Copy the wrong one and you get resource names that no longer exist.

No end-to-end example

Each resource is documented on its own page. Nothing shows a tunnel, an Access app, and a Gateway rule working together.

Silent failures

A missing catch-all ingress rule, a snake_case field where the API wants camelCase, a $ that Terraform interpolates. All quiet until they are not.

How it works

Three steps, no token at any point.

Describe the app

Account and zone IDs, the public hostname, and the local service behind it. Add extra hostnames to serve several apps from one tunnel.

Choose what to deploy

An identity provider, a service token, Gateway DNS filtering, a private network route, remote state. A panel counts every resource before you create anything.

Take the output

Copy any file, or download setup.sh to write the whole folder at once. Then terraform apply or ./deploy.sh.

chmod +x setup.sh && ./setup.sh          # writes every file
export TF_VAR_cloudflare_api_token="<scoped-token>"
terraform init && terraform apply
terraform output -raw tunnel_run_token   # to run the connector

What it handles for you

Every item on the left cost real time to find. Every item on the right is now automatic.

cloudflare_tunnel and cloudflare_record no longer exist in v5. Pins ~> 5 and emits the current resource names.
Ingress silently misbehaves without a final catch-all. Always appends http_status:404 as the last rule.
Terraform interpolates the $ in a Gateway list expression. Uses format() so the literal $ survives.
The API wants camelCase, Terraform wants snake_case. Emits the right casing for each surface.
DNS uses content, not value, pointing at the tunnel. Writes the CNAME to <tunnel_id>.cfargotunnel.com.
Terraform state holds the tunnel token in cleartext. Ships a .gitignore so it never reaches a commit.
Publishing DNS before Access briefly exposes the origin. Paranoid ordering creates Access protection first.

What you get

A complete folder, not a snippet.

Terraform

main.tf variables.tf terraform.tfvars backend.tf

Tunnel, ingress, identity provider, Access policy and app, DNS, Gateway rules, and optional remote state in R2 or Terraform Cloud.

Everything else

deploy.sh setup.sh .gitignore .envrc Brewfile devcontainer.json README.md

A pure API path with curl and jq if you would rather not use Terraform, plus environment setup and a README with the token scopes.

Your token stays yours

The configurator never asks for an API token and makes no network calls. Terraform reads the token from TF_VAR_cloudflare_api_token and the script reads CLOUDFLARE_API_TOKEN, both from your shell. Your profile is saved in your browser and encoded into the share link, so no server ever sees it.