Same outcome (public HTTPS to a self-hosted box without port forwarding), different trade-offs. Cloudflare gives you their edge for free;
asdgives you the routing, the tunnel, and the dev tools — without an account at Cloudflare.
This is an honest comparison. Both tools work. Pick the one whose
trade-offs match what you actually need.
| Cloudflare Tunnel | asd |
|
|---|---|---|
| Public HTTPS | ✅ (Cloudflare edge) | ✅ (your tunnel server) |
| Auto certificates | ✅ (Cloudflare-managed) | ✅ (Caddy, your control) |
| Reverse proxy you control | ❌ (Cloudflare rules / Workers) | ✅ (full Caddy under your config) |
| Routing config in git | Partial (cloudflared config.yml) |
✅ (declarative YAML per service) |
| Self-host the tunnel server | ❌ | ✅ (sish-compatible) |
| DDoS protection at scale | ✅ (Cloudflare network) | ❌ (only what your tunnel server provides) |
| Global edge / anycast | ✅ | ❌ |
| Account required | Cloudflare account | None (or your own tunnel server) |
| Cost at small scale | Free | Free (self-hosted) or pay your tunnel server provider |
| Cost at large scale | Free → Workers/R2/etc. paid | Bandwidth on your tunnel server |
| Dev tools bundled | ❌ (you bring them) | ✅ (web terminal, code-server, DB browser, network inspector) |
Free anycast edge. Cloudflare's network terminates TLS for you
in dozens of cities. Your viewers in Tokyo get a Tokyo POP; viewers
in São Paulo get São Paulo. asd can't replicate that without a
tunnel server in every region.
DDoS protection that scales. If your link gets hit with 50
Gbps, Cloudflare absorbs it. Your home internet does not.
One-account integration with Cloudflare's other products.
Workers, R2, KV, Zero Trust, WAF — all integrated. If you already
pay Cloudflare for anything else, the tunnel is "one more thing"
in the same dashboard.
No tunnel server to operate. Cloudflare runs the receiving
end. With asd you either rent a tunnel server (managed by the
asd team or someone else) or operate one yourself.
Massive docs + Stack Overflow surface. Cloudflare's tunnel
product has been around since 2018; the failure modes are
documented.
asd winsNo SaaS dependency. Cloudflare can change pricing, terms,
feature gating, or rate limits — and on day Cloudflare goes down,
your stack goes with it. asd runs on infrastructure you (or
your tunnel-server provider) control.
Full Caddy under your config. With Cloudflare Tunnel, your
routing options are the cloudflared config.yml (origin selection,
basic hostname rules) and Cloudflare-side rules (page rules,
Workers). With asd, every Caddy feature is available — custom
handlers, mTLS to origin, rate limiting per route, anything Caddy
ships, plus caddy-security for SSO.
Declarative routing in git. Cloudflare's UI rules are clickable
in a browser; they don't live in version control. asd's entire
config is asd.yaml + packages/*/net.manifest.yaml — diffable,
reviewable, copy-able to another machine.
Tunnel server is replaceable. asd speaks sish-compatible
reverse SSH. If your tunnel server provider disappears, point at
another one (or run your own — sish is open source). With
Cloudflare Tunnel, there's no second source.
Dev tools bundled. asd code start, asd database start,
asd terminal start, asd inspect start — code-server, DbGate,
ttyd, mitmproxy, each on its own subdomain through the same
routing pipeline. With Cloudflare, you bring these and configure
them yourself.
Local + public from the same config. Switch tunnel.public: false and the service stays on *.localhost via Caddy's internal
CA, no public exposure. With Cloudflare Tunnel, local-only means
you're not using the tunnel at all.
Pick Cloudflare Tunnel if you need the global edge, you need
DDoS protection, you're already in the Cloudflare ecosystem, or
you don't want to operate any tunnel infrastructure.
Pick asd if you want declarative routing in git, full Caddy
under your control, no vendor lock-in, bundled dev tools, or you
want to self-host the whole stack (including the tunnel server).
Use both is fine: a small project on Cloudflare Tunnel for the
edge, a more involved one on asd for the routing + dev tools.
They don't fight.
learn/01-hello-world.compared/vs-traefik, compared/vs-tailscale-funnel.why.