← projects

warp-detector

A Docker container that serves the TLS beacon Cloudflare WARP uses to recognize a trusted network, so managed device profiles apply automatically.

year
2025
stack
Docker, Python, OpenSSL, Cloudflare WARP, Zero Trust
source
github.com/nutmegitconsulting/warp-detector ↗

Cloudflare WARP can tell when a device is on a trusted network and switch it to a different device profile, for example one that keeps local traffic out of the tunnel. To do that, it connects to a TLS endpoint on the LAN and checks the certificate's SHA-256 fingerprint. Cloudflare documented how to apply managed profiles automatically, but not how to put that certificate on the LAN. Without that endpoint, there's no way to identify different networks and apply those profiles automatically. warp-detector provides it.

How detection works

Diagram: on the LAN, the warp-detector container serves a self-signed certificate on the host IP, port 443. A laptop running the WARP client opens a TLS connection to it. In Cloudflare Zero Trust, a network location holds that IP and port plus the certificate fingerprint and selects a device profile. When the fingerprint matches, the profile applies: LAN traffic goes direct to local devices and everything else goes through the WARP tunnel. Off the LAN there is no answer within 5 seconds, so the default profile applies.
WARP checks the beacon's certificate. A match switches the device to the on-LAN profile.

How it works

  1. Set up once. A throwaway setup run asks for a hostname, generates a self-signed RSA-4096 certificate valid for 10 years in a named Docker volume, and prints the SHA-256 fingerprint ready to paste into Zero Trust.
  2. Run. The same image runs detached on port 443 and restarts with the host. If no certificate exists, it refuses to start and prints the setup command.
  3. Configure Zero Trust. Add a network location with the host's static IP and the fingerprint, then a device profile that matches it and excludes the LAN ranges from the tunnel.
  4. Verify. One openssl command, from PowerShell or Linux on another machine, should return the same fingerprint.

Design decisions

  • One image, two modes. Setup is interactive and disposable. The server is headless. The certificate lives in a volume, so rebuilding or upgrading the image never changes the fingerprint and never means updating Zero Trust again.
  • Paste-ready output. Fingerprints usually print with colons, and the dashboard needs them removed. Setup strips them, because that's exactly where people go wrong.
  • Least privilege. The entrypoint runs as root only long enough to set ownership of the new certificate, then hands the server to a non-root user.
  • Nothing to maintain. About 40 lines of Python standard library answer every request with 200 OK. WARP cares about the TLS handshake, not the body.

Outcome

The approach was shared with Cloudflare at Cloudflare Connect in August 2025, Cloudflare's first global conference. In October 2025 Cloudflare's Managed Networks documentation added a containerized setup for this endpoint.

The project is open source under the MIT license: nutmegitconsulting/warp-detector.