# Secured PDF Toolkitwith Cloudflare Access

I really like the idea of having access to a PDF toolkit without having to upload personally identifiable information to what amounts to a black hole. There are thousands of websites you can use to perform a myriad of operations on PDFs. The problem is, I have no idea what happens to documents after you upload them. Some websites pinky-promise that they'll delete your information right after uploading, while others claim to process your document exclusively within your browser, but there is almost no way for the average person to verify whether this is actually true.

![A meme with of a man clasping his hands with the caption: I receive: all your personal data - you receive: a nice pdf. ](https://cdn.hashnode.com/uploads/covers/6806c7add8fc83d6ac0f8119/6aa5138b-22e9-493b-933e-b82e7cd2e16d.png align="center")

I first started with [StirlingPDF](https://github.com/Stirling-Tools/stirling-pdf), I configured and ran it for quite some time, and I liked it. After further research, I found they were collecting minimal telemetry, such as usage data, which was not particularly egregious. I wanted to own whatever I installed on my server.

So I switched to [**BentoPDF**](https://www.bentopdf.com/index.html)**,** and according to Reddit and most of the self-hosting community, this is a better, more privacy-focused option than StirlingPDF.

![Screenshot of the main page of Bento PDF. The text "The PDF Toolkit built for privacy"](https://cdn.hashnode.com/uploads/covers/6806c7add8fc83d6ac0f8119/a56646dc-2764-4005-a268-dbcffbb6cb9e.png align="center")

So I switched to [**BentoPDF**](https://www.bentopdf.com/index.html)**,** and according to Reddit and most of the self-hosting community, this is a better, more privacy-focused option than StirlingPDF. BentoPDF has a ton of tools, and I have been using it for a few months now. Here is how I configured it.

I used Portainer to create a Stack. In the stack, I added the following lines of code.

```dockerfile
services: 
    bentopdf: image: bentopdf/bentopdf:latest 
        container_name: BentoPDF 
        healthcheck: test: ["CMD-SHELL", "nc -z 127.0.0.1 8080 || exit 1"]                     
    interval: 10s timeout: 5s retries: 
        3 start_period: 90s 
    ports: - 3063:8080 
    restart: on-failure:5
```

Then I started the stack. This pullled the image from `ghcr.io/alam00000/bentopdf:latest`, then started the stack with

`docker-compose up -d`

## Worldwide Access with Tunnels and Auth!

The best part of this project, though, is having access to it wherever I am in the world. Now, if I were to expose the port to the internet, that could be really bad for a host of reasons, so I didn't. I used the awesome Cloudflare Tunnel, which I've used so many times within my projects. I know there are other tools out there, but until Cloudflare gives me a reason not to, I'm sticking with Cloudflare tunnels.

First, since I already have a tunnel running on my server, it was a breeze to set up. I could have used the CLI, but I find it's harder to troubleshoot when I do, since you don't have as much control over it via the GUI. I detailed everything about setting up Cloudflare Tunnels in a previous post on how I set up Vaultwarden on my [Raspberry PI](https://hughj.dev/vaultwarden-on-raspberry-pi).

![Dashboard showing Cloudflare Tunnels redacted for privacy](https://cdn.hashnode.com/uploads/covers/6806c7add8fc83d6ac0f8119/b0d1c529-f1f7-49bf-b16e-072a04859f2e.png align="center")

Essentially, once you have an existing tunnel on that server, you'd just go to the GUI and add a Published Application Route:

![](https://cdn.hashnode.com/uploads/covers/6806c7add8fc83d6ac0f8119/0df9afac-c4a4-4467-b7d8-e476d3874f19.png align="center")

Next, you'd enter information such as the subdomain, which will automatically create a new CNAME record for you in Cloudflare DNS.

Next, you'd select the domain if you have multiple like it. You can add a "Path," but that's optional.

\
The most important step though, is adding the Service details. The "Type" being what protocol your service is running on, here it would be `http` so you'd select that, next add the URL, which is `localhost:<port>`. In this example, from the compose file above, I used port `3063`. From there, it's a simple `docker compose up -d` to run the container in detached mode and once the images are pulled and created, you should be good to go.

In short, you now have a secure, self-hosted PDF editor accessible from anywhere, even outside your home network. This allows you to edit sensitive documents without significant privacy concerns. However, keep in mind that data transmitted via Cloudflare Tunnel is visible to Cloudflare. For enhanced security, consider using Tailscale instead; I will cover setting up a Tailnet in a future post.