I own a tiny Raspberry Pi that I use to self-host lightweight applications without paying for a VPS. The services running on this little machine are exposed to the internet through Cloudflare Tunnel and protected by Cloudflare Zero Trust. It is an amazing free service that should be the go-to option for exposing anything private on the internet, but that topic is reserved for another time.

So, I wondered: since I can expose my SSH server through this service, would it be possible to create a GitHub action that connects to my homelab’s Pi and deploys the latest version of my services? By “deploys”, I mean rebuilding the Docker images. Turns out, it is possible — and it is pretty straightforward.

First, you need to expose the SSH server running on localhost to Cloudflare Tunnel as a dedicated application. Then, assign a proxy CNAME to that application and restrict access with a dedicated service token. Finally, by using cloudflared to authenticate, you can SSH into the machine and run the Bash command that updates the services.

The GitHub action that does the above is here