Remote access

Before you share a link

Turn on Require sign-in to see the wall (Admin → Shop) and make sure staff have strong passwords. Anyone with the link can otherwise see the anonymized wall and submit requests.

Test mode (five minutes, no account)

Admin → Remote access → Turn remote access on. WorkloadWall opens an outbound tunnel with the bundled Cloudflare client and shows a random …trycloudflare.com address within about 30 seconds. Share it with remote staff; they sign in with the same accounts as on the LAN.

Good for trying it out. The address changes whenever the tunnel restarts, and there's no extra login in front of the app.

Permanent address with a login gate (recommended)

Use a free Cloudflare account and your own domain to get a fixed name like wall.yourcompany.com with a sign-in page in front of it — remote staff enter their email, get a one-time code, and only addresses you've listed can get through. The app's own login still applies behind it.

1. Put your domain on Cloudflare (free plan).
2. Zero Trust → Networks → Tunnels → Create a tunnel (Cloudflared). Name it after the PC.
3. On the Install connector step, copy the command. On the WorkloadWall PC, open Command Prompt as Administrator and run it — but replace the leading cloudflared.exe with the copy WorkloadWall already installed: "C:\Program Files\WorkloadWall\bin\cloudflared.exe" service install <token>
4. Route tunnel → Published application: subdomain wall, your domain, service HTTP → localhost:3000. Complete setup.
5. Zero Trust → Access controls → Applications → Add → Self-hosted: the same hostname; add a policy Allow with the staff emails; create.
6. Back in WorkloadWall, Admin → Remote access → Permanent address: enter the hostname (wall.yourcompany.com) and save. The page then shows whether the connector service is running on this PC and whether the address answers from the internet.
7. Turn test mode off so only one tunnel runs.

The tunnel runs as a Windows service, starts at boot, and reconnects on its own. Add or remove people in the Access policy — no change in WorkloadWall.

Diagnostics

The bottom of the Remote access page shows the tunnel task status, whether the client is bundled, and the last lines of the logs. Screenshot it if you need help.