A Small Development Server with Cloudflare Email Login

A freelancer, a two to ten person development shop, or a small business with one technical person can use a cheap server for staging sites, client previews and internal tools, with Cloudflare Access requiring an approved email login before visitors reach them.

Start with work that can wait while you fix the machine. Skip this single server design for production that needs a contractual service and recovery commitment, regulated data without a compliance plan, or any system whose failure would stop the business. A provider's SLA doesn't supply your application's backup, failover or administrator.

The appeal is practical: you can show a client a working page without opening your development app to every visitor. You control the software and can rebuild the environment. When an update breaks the app, someone on your side fixes it.

We read the official sources on October 29, 2026. We have not provisioned this setup for the article. The kit's tunnel configuration received offline syntax and hostname matching checks; actual login, firewall and recovery tests remain tasks for your own new server.

Kimsufi or a small VPS

Kimsufi is OVHcloud's budget dedicated server range. You rent a physical machine. A small VPS is a virtual machine on hardware the provider operates, often with shared CPU capacity. Dedicated hardware can offer a lot of memory for little money, while a VPS can be easier to size for a modest preview.

These selected offers come from the US Kimsufi page and its full catalog. The first four displayed “Coming Soon”; the last four had a Configure option. Prices are advertised US dollars before tax, not confirmed orders.

Capacity ranges do not establish the disk technology or variant sold at the starting price. The KS-5 configurator showed Hillsboro available and Vint Hill unavailable for the displayed configuration. Minimum commitment and final order terms were not verified without entering a cart. Confirm them and delivery before purchase. The full catalog has additional models.

The Kimsufi page advertises a 99.9% SLA. It would be wrong to describe the whole range as having no SLA. It would also be wrong to describe every model as having no disk redundancy: the entry single disk models differ from the multiple disk offers. None of these rows buys a second application server ready to take over.

OVHcloud's support statement includes replacement of defective hardware, but excludes software support and makes backups your responsibility. Ticket and chat support are not a managed operating system service. Plan for stock variation and for recovery work after hardware replacement.

For a smaller first project, compare these published virtual machine tiers from our shared series cost research:

The DigitalOcean prices are full month caps without an annual commitment. The OVHcloud VPS page and VPS-1 configurator displayed $54.48 before tax for 12 months. That is a different billing basis. With no commitment, the configurator showed $5.35 per month before tax for VPS-1 in Vint Hill or Beauharnois, no setup fee line, and its standard automated backup included at no charge. The 6 and 12 month commitments save 5 and 15 percent and renew automatically unless you turn renewal off. We still use the $24 DigitalOcean tier as the worked budget because the whole series uses it; at $5.35 the OVHcloud VPS would cut about $670 from each self hosted 36 month total below, before any difference in performance or support.

The shared research also lists Vultr's CPU Compute Intel E3-1270 bare metal server from $120 per month, with 4 cores, 8 threads, 32 GB RAM and two 240 GB SSDs. That is a physical server comparison, not a small VPS tier. There is little reason to choose it for this tiny preview solely to save on hosting.

Our default is the $24 VPS until measured memory or storage needs justify something else. A 32 GB dedicated machine is attractive for builds or several disposable environments, but older CPUs and uncertain delivery are tradeoffs. The cheapest offers have one disk. None of these workload suggestions is an application benchmark.

What the tunnel actually changes

Cloudflare Tunnel gives your server a way to answer web requests without accepting inbound web connections. The cloudflared program connects outward to Cloudflare. A visitor reaches Cloudflare first, passes the Access check, and reaches your application through that connection. Your application can listen only on the server's loopback interface. You don't need a public DNS record pointing to the server's address or an inbound rule for ports 80 and 443. Cloudflare's terminology calls this an outbound only pathway.

That is useful for a preview site. A client can open an ordinary web address, enter an approved email address, and retrieve a code from their inbox. They don't need a VPN client for the web page. A stranger who guesses the address gets the login screen, rather than your unfinished app, provided you created and tested the Access policy.

The hostname is still public. Treat it as discoverable. The server's address may already appear in historical records or unrelated services; a tunnel cannot erase that history. Closing direct inbound access is what removes that route around the login screen.

This doesn't patch your application, protect a stolen mailbox, or prevent compromised code from calling out to another server. It doesn't make a database backup. You still need operating system updates, application permissions and a recovery plan. SSH also needs its own policy. A tunnel for the website does nothing to secure an SSH port you left open to everyone.

Multiple connector connections still depend on your one machine. Two connectors on the same failed server cannot bring it back.

Pick one way to manage the tunnel

For a small shop, start with a remotely managed tunnel. Its configuration lives in Cloudflare, and you install the connector using the token supplied by the dashboard. Someone covering your vacation can inspect routes without guessing which configuration file was last edited. Cloudflare's current menu calls this Networking > Tunnels.

A locally managed tunnel stores its configuration in a config.yml file. You create it with the command line, supply the tunnel credentials file, and define the services and final catch all rule yourself. This suits someone who wants configuration review and already manages server files carefully. Keep the credentials out of Git even if the nonsecret configuration is versioned.

Both management methods need Access. The kit gives both paths; choose one instead of installing competing services.

Give each application its own email door

For this setup, use an active domain on Cloudflare DNS. Cloudflare Tunnel publishes a route; Access decides who may use it. Cloudflare explicitly recommends creating the Access application before adding the tunnel route. Without that application, publishing the route can make the service available to anybody.

Start with one hostname for a client preview and another for an internal tool. Give each its own self hosted Access application and policy. The client belongs in the preview policy. Your employees belong in the internal tool policy. Don't give every client access to every hostname just because a wildcard is convenient.

The login method is named One-time PIN. It sends a code to the email address; the code expires after ten minutes. Current Cloudflare instructions say new organizations do not receive this method automatically. Add it under Zero Trust > Integrations > Identity providers and enable it for the application.

Use an Allow policy with specific Emails for a client preview. Emails ending in can admit your whole company domain, but that includes every qualifying mailbox. It makes sense only when someone controls account creation and promptly removes former staff. Never use a public email provider's domain to stand in for a list of people.

Here is what your client experiences: open the preview address, enter the approved email, open the message, enter the code, then see the site. Cloudflare deliberately displays a generic message even when a disallowed address will receive no code. That reduces information disclosure but can confuse your test. Test an allowed address and a separate address outside the policy, not just your own remembered session.

Email confirmation proves access to a mailbox. It isn't a promise of strong multifactor authentication. Protect those mailboxes, and consider your existing identity provider when the material is sensitive. Keep the application's own accounts and permissions where users have different jobs inside it.

Set a session duration deliberately. Our starting choice is eight hours for a working day, with a shorter session for a brief client review if useful. The documented default is 24 hours. Global and application sessions interact: an expired application session may renew while the global identity session remains valid. Set both to match the intended login interval instead of promising a fresh email code based only on the application setting.

When someone leaves, remove their Allow rule or disable the identity that satisfies a domain policy, revoke their Access sessions, and remove their application account and server keys. Revocation alone isn't permanent exclusion if their identity still meets an Allow rule. Also review tokens they could have copied. An existing SSH connection needs separate attention; the web application's session duration doesn't terminate an active SSH session.

For an unattended build or health check, use an Access service token with a Service Auth policy. The script sends its Client ID and Client Secret in the documented headers. Give each job its own token and expiry. Don't grant a Bypass rule just to stop a build from seeing the login page. A token gets through Access; the application may still require its own API credential.

The Zero Trust pricing page, read October 29, lists Free at $0 with a 50 user limit and Pay-as-you-go at $7 per user per month. Free support is through the community. Standard log retention is up to 24 hours on Free and up to 30 days on Pay-as-you-go. The ordinary Cloudflare website plans are a separate purchase category; a paid website plan isn't the prerequisite for this Free Access example.

Count clients as well as employees when planning seats. Ten employees plus dozens of rotating reviewers can exceed the small team you had in mind. At ten paid users, the published rate would add $70 per month, or $2,520 over 36 months, before tax. The examples below stay within Free's user limit.

Put it together without locking yourself out

The downloadable kit carries the commands. This is the order and the reason for it.

First, order a machine you can rebuild and install a supported Ubuntu LTS image offered by the provider. This kit uses Ubuntu 24.04 LTS. Save the provider's recovery instructions before changing the firewall.

Next, create an ordinary administrative user, add your SSH public key, and prove you can open a second session with that account. Update packages, configure unattended security updates, and check the SSH settings. Don't close your original session until the new one works. Ubuntu's OpenSSH guide explains keys and validating configuration before restarting the service.

Configure the firewall to deny unsolicited inbound traffic. Initially allow SSH only from your current administrator address. Keep outbound traffic working so the connector can reach Cloudflare; Tunnel's firewall documentation lists its outbound requirements.

Install cloudflared from Cloudflare's official package repository. Create the Access applications and email policies before publishing hostnames. Then create the tunnel, install its service, and add each hostname's local destination. A staging app on port 8080 and a wiki on another port can use the same tunnel with different Access applications.

Enable Protect with Access on the route where available, or implement the documented token validation in the origin. Cloudflare's application guide recommends validating the Access token at the connector or application. Merely trusting a header that looks like an email address is not sufficient identity verification.

Open each address in a private browser window. Confirm the permitted person gets in and the unlisted person doesn't. Test each hostname separately. Then test the server's public address from outside: it must not offer the application around Access. Check IPv6 as well as IPv4 if the server has both.

If you use containers, inspect their published ports as part of this test. A loopback destination in the tunnel doesn't prove the container isn't also listening on a public interface. The goal is one controlled route to the service, with the test result recorded.

Finally, reboot during a planned window. Confirm the application and connector start without your terminal, and perform a restore of some disposable data.

Move SSH behind Access only after testing recovery

Cloudflare documents SSH through client side cloudflared. Publish a separate SSH hostname, protect it with an administrator only Access application, and configure the SSH client to use cloudflared access ssh as its proxy command. SSH still authenticates the server account with its key.

This gives you a way to close public port 22 after proving the new connection works. Test it from a second terminal before removing the temporary firewall rule. Do not give a client who reviews a website the SSH policy too.

Browser rendered SSH is another documented option, with its own account mapping and policy restrictions explained in the kit. It isn't necessary for this setup. The native SSH route is easier to fit around an existing SSH key workflow, and you shouldn't turn on password authentication merely to make a browser terminal convenient.

For a VPS, learn the provider's console or rescue route. For Kimsufi, OVHcloud confirms there is no IPMI access. Use its rescue mode from the control panel; the kit gives the confirmed menu steps. Keep recovery independent of the tunnel. If the connector fails, you cannot repair it through that same failed connection.

What a normal working day could look like

These are planning illustrations, not customers or installations we performed. Each starts with a single host and synthetic or ordinary internal information. The cost section prices the whole host, including administration; adding another hostname doesn't give it separate RAM or a separate backup budget.

A three person web design shop. The problem is, "The client keeps forwarding screenshots of the wrong revision." Put the current staging site behind a client specific hostname. Allow the designer and two named client contacts. On a normal day the designer publishes a change and sends the same URL; the client signs in and reviews the current page. Use the small VPS budget below for one modest site. Revoke the client reviewers when the project ends and archive the content deliberately.

A four person bookkeeping firm. The problem is, "We need one place to test our document naming and review process." Start an internal document tool with dummy statements and sample invoices, admitting the owner and two staff reviewers by individual email. A normal day replaces emailed sample folders with one review queue. Use the same small VPS cost envelope, but check the GLBA Safeguards Rule and other applicable duties before putting client financial or tax records there. This example does not establish compliance, and real client records require a separate security and retention decision.

A six person property management office. The problem is, "Every maintenance idea gets lost in a spreadsheet nobody agrees on." Let the manager and dispatcher test a maintenance request prototype using fictional tenants and addresses. During the day they try assignment, completion photos and overdue filters. Contractors don't automatically belong in the staff domain policy. Budget the VPS initially, then measure storage before allowing real photographs to accumulate.

An eight person print shop. The problem is, "Can the front counter see which proof is waiting?" Test an order dashboard with sample jobs and individual email access for the estimator, production lead and owner. They check status between jobs instead of asking a developer to demonstrate every screen. A Kimsufi box may suit memory hungry builds. Use the KS-5 budget below only if the selected disk configuration and order terms fit; larger files need their own backup allowance.

A nine person HVAC company. The problem is, "A quote gets revised in the office and the technician doesn't see it." Test a Laravel quote tracker with fictional customers, one dispatcher and two technicians. The morning review can expose a missing field before anybody replaces the live quoting process. Use the small VPS envelope. Once scheduling or invoicing depends on it, fund production hosting and a recovery target separately.

A nonprofit with two staff and twelve regular volunteers. The problem is, "The event instructions live in last year's email." JSPWiki is one possible wiki, covered in the Apache websites and web apps guide. Admit named volunteers and keep edit permissions inside the wiki. On a normal day a coordinator updates the pickup instructions and everyone sees the same page. Budget the small VPS and test the Java application's actual memory use before sharing the host with other projects. Keep donor records elsewhere.

A five person development shop. The problem is, "We want a place for internal repositories and issue notes." Gitea is a third party Git service, separate from Cloudflare and OVHcloud. Put its browser interface behind staff Access policies. Developers read issues and review changes during the day; Git clients and CI need separately tested authentication, not an assumption that browser email login will work in every tool. A larger VPS or Kimsufi can become reasonable when builds need memory. The comparison budget excludes build runners and their resource usage.

Don't combine all seven examples on one small host and expect the quoted cost to remain meaningful. Measure peak memory, disk growth and build contention for your actual combination. Separate clients when their data or code should not share the same administrator and failure boundary.

The 36 month bill, including your time

For a comparable buying decision, assume one small development environment with a stateless preview app, two to ten approved people, and 50 to 200 GB of retained source artifacts and test fixtures in independent backup storage. Those are our low and high planning assumptions. They are not disk requirements or measured application performance.

The managed comparison is Render Pro at $25 per workspace per month plus its 2 CPU, 4 GB compute instance at $85 per month: $110 combined. Preview environments require Pro or above and charge for their running resources. This budget buys one continuously running app, not unlimited simultaneous previews.

Render manages more of the hosting work, but this is a hosting comparison, not an identical email security package. Its web services have a public default hostname. Putting Access on a custom domain alone does not protect that other address. The managed choice needs application authentication or another verified enforcement design; custom authentication development is excluded from both budgets. Render workspace seats are not your app's user accounts.

For retained data, Backblaze B2 lists $6.95 per decimal TB per month, with the first 10 GB free. Storage is (retained GB minus 10) × $0.00695, floored at zero: $0.278 monthly for 50 GB and $1.3205 for 200 GB. Count versions, not just today's files. These examples assume downloads stay within B2's free allowance of three times average monthly stored data and incur no chargeable API calls.

Our employee compensation proxy is $68.09 per hour, based on the BLS administrator wage of $47.66 divided by the private industry wage share of 0.700, rounded to cents. It isn't a contractor's billing rate. An owner spending Saturday on updates is spending time even without receiving an invoice.

For either self hosted server, our shared assumptions are 4 to 12 setup hours and 1 to 3 administration hours a month. For managed hosting, our additional assumption is 1 to 3 setup hours and 0.25 to 0.75 administration hours monthly. Managed hosting still needs deployment checks, access reviews and backup attention.

Formula: setup hours × $68.09 + server setup fee + 36 × (monthly hosting + B2 + monthly admin hours × $68.09). Calculate before rounding. For example, the low VPS case is 4 × $68.09 + 36 × ($24 + $0.278 + 1 × $68.09) = $3,597.608, displayed as $3,598.

Break even is the extra setup cost divided by the monthly saving, rounded up to a whole month. The low VPS case is ceiling(($272.36 minus $68.09) / ($127.3005 minus $92.368)) = 6. In the high case, self hosting costs more at setup and every month, so it never breaks even under these assumptions.

The Kimsufi arithmetic uses KS-5 at its advertised $20 monthly starting price plus $20 setup. A configuration was available, but commitment and final variant pricing still need checkout confirmation. No provider is assumed to freeze prices for three years.

All figures are US dollars before tax. Domain registration, custom development, training, major incidents and compliance work are excluded. The Render example has no paid database or persistent disk; its price page lists disks at $0.25 per GB monthly if needed. Concurrent previews, bandwidth overages and a different app footprint change the result. An outside IT provider needs to quote its own labor and response terms.

Managed hosting wins this comparison when self hosting takes three hours a month and the managed app needs substantially less attention. It can also win when your only technical person needs to take a vacation, or when deleting a preview after a pull request closes is worth more than a low machine price. Choose the platform your team can keep boring.

The upkeep that makes the low price honest

Name a primary administrator and someone who can cover them. Keep a record of hostnames, approved people, application owners and backup locations. Review it when projects finish. A forgotten preview with a former client's mailbox still allowed is easy to create and easy to prevent.

Treat the tunnel token as a secret. Don't paste it into an issue, public repository or client email. If it leaks, rotate it and replace the connector's credentials using Cloudflare's token guidance. Also inspect active connectors and follow the compromised token procedure; changing a token is not a substitute for checking existing connections.

Keep cloudflared current. Cloudflare supports versions within one year of its latest release. That is a support boundary, not an annual patch schedule. Its release history shows multiple releases during October 2026, so there is no useful promise that one monthly release is all you must consider. Use the package manager for package installations, restart the service after updating, and confirm the running connector. Cloudflare's update guide warns that restarts affect current traffic.

Keep backups off the server and outside its provider account where practical. Include the database, uploaded files and enough configuration to rebuild. Encrypt sensitive backups and keep the recovery key somewhere you can reach after losing the host. Mirrored disks help with a disk failure; they don't undo an accidental deletion, a bad update or compromised credentials.

Choose an acceptable loss window and recovery time. For a disposable prototype, yesterday's sample data may be enough. For a client's only copy of uploaded artwork, it probably isn't. Restore a representative file and database into a separate test location, record how long it took, and repeat after meaningful changes.

Use monitoring and logging to notice a dead app, a nearly full disk or a failed backup before a client notices. A monitor needs its own restricted Access service token if it checks the protected page. Otherwise it may happily report that the login screen is up while the application is broken.

Review Access authentication logs under Zero Trust > Insights > Logs. They tell you about login decisions, not every action inside the app. Keep application audit records if you need to know who changed a document. Free's short retention is another reason to avoid claiming this arrangement meets a compliance requirement by itself.

The simplest operating rule is to keep production customer data off the development box until someone has approved a specific data, access, backup and incident plan. A cheap server is useful because you can experiment on it. Give it that job first.

Download the setup kit

Download the Cloudflare development server kit for the prerequisites, Ubuntu commands, both tunnel management paths, email policy, CI token, SSH option, recovery checks and matching cost worksheet. Start with a disposable application and finish the deny test before inviting a client.

If you are building a small service business around this work, The $20 Dollar Agency covers the broader business side. The server remains one tool in that business, with somebody responsible for looking after it.

Related reading

1. Build a self hosted AI server from scratch for the larger server architecture and access boundaries.
2. One safe update command for a self hosted server for why an installed update isn't always a running update.
3. Cloudflare's developer platform for other places a small application can live.
4. The dedicated AI workstation cost comparison for a different workload that can justify dedicated hardware.
5. Laravel for small business for the quote tracker example.
6. Apache projects for small business for the software catalog, including wikis and monitoring.
7. Kasm Workspaces on your own subdomain for streamed browsers and Linux desktops behind the same email login, with license and server costs.

Fact-check notes and sources

Prices and documentation were read October 29, 2026. Provider and Cloudflare reads took place from 22:25 UTC onward; the shared price and labor research was read from 21:10 to 21:19 UTC. Exact order terms and availability must be checked again before purchase. The illustrations and labor ranges are our assumptions, not customer results.

1. US Kimsufi offers, full Eco catalog, OVHcloud support scope, VPS offers and VPS-1 order configuration. Read October 29, 2026. Kimsufi commitment and delivery remain unverified; some offers say “Coming Soon,” while KS-5 had an available configuration. Recovery documentation was confirmed in a regular browser on the same date.
2. DigitalOcean prices, Linode plan catalog, Vultr prices and Backblaze prices. Shared series research, October 29, 2026. B2 says “$6.95 / TB / mo.”
3. BLS administrator profile and compensation wage share. Shared series research, October 29, 2026; May 2025 wages and June 2026 compensation share.
4. Render prices, preview environments, web services and persistent disks. Read October 29, 2026. Preview compute and application login are separate considerations.
5. Cloudflare plans and Zero Trust pricing. Read October 29, 2026; “50 user limit” on Free and “$7/user/month” on Pay-as-you-go.
6. Cloudflare's tunnel terminology, self hosted Access applications, One-time PIN, sessions, service tokens and authentication logs. Read October 29, 2026.
7. Cloudflare's SSH client method, firewall requirements, tunnel permissions, supported versions, updates and release history. Read October 29, 2026.
8. Ubuntu OpenSSH, Gitea and JSPWiki. Read October 29, 2026. FTC Safeguards guidance was confirmed in a regular browser at 22:05 UTC; tax preparation firms appear among covered institutions.

This post is informational, not security, legal or IT consulting advice. Product names identify the services discussed; no affiliation or endorsement is implied.