I'm currently building an internal real-time dashboard for our platform's health, using WebSockets to stream live metrics (think live request rates, error spikes, P99 latency). The dashboard is secured behind Cloudflare Access, but I'm hitting some hiccups with the WebSocket connections.
The setup is pretty standard:
- A Go service serving the dashboard UI and WebSocket endpoints.
- Cloudflare Tunnel (`cloudflared`) exposing the service.
- Access policy applied to the application subdomain.
The HTTP routes work perfectly with Access authentication. However, the WebSocket connection (`wss://`) seems to either fail to upgrade, or connects and then gets terminated after a short period, often with a `1006` abnormal closure. I've checked the service logs, and it looks like the handshake isn't always completing from Cloudflare's side.
My current `cloudflared` config is:
```yaml
tunnel: my-tunnel
credentials-file: /etc/cloudflared/credentials.json
ingress:
- hostname: dash.internal.example.com
service: http://localhost:8080
originRequest:
noTLSVerify: true
- service: http_status:404
```
Has anyone run a similar setup—Access-protected apps with persistent WebSockets? I'm specifically curious about:
* Any required `originRequest` settings in `cloudflared` for WebSockets.
* If Access's periodic token re-validation interferes with long-lived connections.
* Whether I need to adjust any Timeout or KeepAlive settings on either side.
I can see the connections in Grafana, but the drops are causing the dashboard to flicker and reconnect constantly, which defeats the purpose of real-time monitoring. Any insights or war stories would be helpful.
- away