Operator access

Set up remote access

Publish the admin UI through Cloudflare Tunnel or keep it behind SSH forwarding.

Choose an endpoint

Method	Best for	Boundary
SSH local forward	Local hosts and recovery	The UI stays on loopback; your SSH client forwards port 7443.
Cloudflare Tunnel	Always-on browser access	cloudflared publishes one hostname to http://localhost:7443.

Configure Cloudflare Tunnel

1
Add your domain to Cloudflare
The hostname must sit on a domain whose DNS Cloudflare manages, because publishing the route creates the DNS record for you.
2
Create a remotely managed tunnel
In Zero Trust, open Networks, then Tunnels, create a cloudflared tunnel, and copy the tunnel token.
3
Attach a public hostname to the tunnel
On the tunnel's Public Hostname tab, add a hostname such as kern on your Cloudflare domain. That binds the hostname to this tunnel, and Cloudflare writes the DNS record for you.
4
Tell the tunnel where to forward
On the same route, set the service type to HTTP and the URL to localhost:7443. Cloudflare terminates the request at the edge and the tunnel hands it to the admin UI from inside the host, so port 7443 is never exposed.
5
Pass the token outside CLI arguments
Set KERN_CLOUDFLARE_TUNNEL_TOKEN in the deployment shell.
6
Deploy or reconfigure
Supply --operator-cloudflare-hostname with the exact published hostname.

Reconfigure the host with the exact hostname you published.

Reconfigure a local host

export KERN_CLOUDFLARE_TUNNEL_TOKEN='eyJ...'
python3 -m host.cli.reconfigure \
  --provider lima \
  --agent-name my-kern \
  --admin-password-sha256 <new-sha256> \
  --operator-cloudflare-hostname kern.example.com

Reconfigure an AWS host

export KERN_CLOUDFLARE_TUNNEL_TOKEN='eyJ...'
python3 -m host.cli.reconfigure \
  --provider aws \
  --agent-name my-kern \
  --admin-password-sha256 <new-sha256> \
  --operator-cloudflare-hostname kern.example.com