n8n behind a Cloudflare Tunnel holds when the ingress targets the Compose service name and internal listen port on the same user-defined network as cloudflared, and the public webhook and editor hostnames stay stable end-to-end — path and authority exactly what n8n was configured to trust. Terminate TLS at the Cloudflare edge for those names, keep the tunnel hop private, and gate the editor UI with Access (or another SSO hop) while leaving only the webhook routes that must accept unsigned callers. Avoid publishing n8n on the host and pointing the tunnel at localhost; that break shows up the moment cloudflared moves into its own container or another node.

After changes I confirm the connector is healthy, probe n8n by service name from inside the cloudflared network (editor and a test webhook path), then the same hostnames through the public edge. A 502 with a green tunnel is usually wrong network membership, a renamed Compose service, or ingress still aimed at a host-mapped port. When webhook signatures or callback URLs start failing after a rename, check that n8n’s public base URL still matches the Access-free hostname the tunnel actually serves — drift there looks like an app bug when it is really edge routing.