GCP + Cloudflare Tunnel

• HTTPS with no Nginx, Caddy, or Let’s Encrypt setup
• No public inbound ports required — the VM only makes outbound connections
• Free on Cloudflare’s free plan
• Pairs naturally with GCP VMs running Gmail-integrated apps (same Google Cloud project)

​

Prerequisites

• A Google Cloud account with billing enabled
• A Cloudflare account (free tier) with a domain managed by Cloudflare DNS
• SSH access to GCP (via gcloud CLI or browser-based SSH)

​

1. Create the Compute Engine VM

1. Go to Compute Engine → VM instances → Create instance
2. Name: inbox-zero (or your choice)
3. Region/Zone: choose one close to your users
4. Machine configuration:
   • Minimum: e2-medium (2 vCPU, 4 GB RAM) — add swap if using this size
   • Recommended: e2-standard-2 (2 vCPU, 8 GB RAM)
5. Boot disk:
   • OS: Debian 12 or Ubuntu 24.04 LTS
   • Size: 20 GB minimum (Docker images + logs)
6. Firewall: leave HTTP and HTTPS checkboxes unchecked — Cloudflare Tunnel handles all ingress
7. Click Create

​

Optional: Reserve a static external IP

​

2. Install Docker and Docker Compose

# Update packages
sudo apt-get update && sudo apt-get upgrade -y

# Install Docker Engine
curl -fsSL https://get.docker.com | sudo sh

# Allow your user to run docker without sudo
sudo usermod -aG docker $USER
newgrp docker

# Verify
docker --version
docker compose version

​

Add swap (required for e2-medium)

sudo dd if=/dev/zero of=/swapfile bs=128M count=32
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile swap swap defaults 0 0' | sudo tee -a /etc/fstab

​

3. Set Up Cloudflare Tunnel

​

Create the tunnel

1. Go to Zero Trust → Networks → Tunnels → Add a tunnel
2. Choose Cloudflared as the connector type
3. Name the tunnel (e.g. inbox-zero)
4. Follow the install instructions for Debian — copy the cloudflared install command shown in the dashboard and run it on your VM:

# Example — copy the exact command from the Cloudflare dashboard
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

5. Run the service install command shown in the dashboard. It looks like:

sudo cloudflared service install <YOUR_TUNNEL_TOKEN>

​

Configure the public hostname

1. Go to the Public Hostnames tab
2. Click Add a public hostname
3. Subdomain: e.g. inbox (resulting in inbox.yourdomain.com)
4. Domain: your Cloudflare-managed domain
5. Service: http://localhost:3000
6. Save — Cloudflare automatically adds a CNAME DNS record

​

4. Set Up Inbox Zero

​

Option A: CLI (recommended)

# Install Node.js (required for the setup CLI)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs

# Run the setup wizard
npx @inbox-zero/cli setup

​

Option B: Manual

git clone https://github.com/elie222/inbox-zero.git
cd inbox-zero
cp apps/web/.env.example apps/web/.env
nano apps/web/.env

# Your Cloudflare Tunnel public hostname
NEXT_PUBLIC_BASE_URL=https://inbox.yourdomain.com

# Google OAuth
GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...

# LLM provider/model
DEFAULT_LLMS=anthropic:claude-sonnet-4-5-20250929
ANTHROPIC_API_KEY=...

​

5. Start the Application

NEXT_PUBLIC_BASE_URL=https://inbox.yourdomain.com docker compose --profile all up -d

docker ps
docker logs inbox-zero-services-web-1 -f

​

6. Update Google OAuth Redirect URIs

https://inbox.yourdomain.com/api/auth/callback/google

​

Maintenance

​

Restart after a VM reboot

systemctl status cloudflared
docker ps

​

Update to the latest image

docker compose pull
NEXT_PUBLIC_BASE_URL=https://inbox.yourdomain.com docker compose --profile all up -d

​

View logs

docker logs inbox-zero-services-web-1 -f
journalctl -u cloudflared -f

​

Troubleshooting

• The app container may still be starting up — wait 60 seconds and refresh
• Check docker logs inbox-zero-services-web-1 for startup errors

• Check journalctl -u cloudflared for errors
• Verify the VM has outbound internet access (should work by default on GCP)

• Ensure NEXT_PUBLIC_BASE_URL exactly matches the redirect URI registered in Google Cloud Console
• Must match the Cloudflare hostname including https://