There’s also an accessible PDF (using handwriting recognition).
]]>Pairing the tunnel with Cloudflare Access gates the SSH endpoint behind an identity layer: only authenticated users with the right policy can reach it. This guide covers the tunnel setup on the Pi, the Access application with identity provider and MFA, and the SSH client config to connect through it.
Validated end to end in July 2026 with cloudflared 2026.7.1 on a Pi running Debian 13 (trixie).
cloudflared on the Raspberry PiInstall the cloudflared daemon, via the Cloudflare Package Repository.
# add cloudflare gpg key
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
# add the stable build for Debian to your apt repositories
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
# install cloudflared
sudo apt-get update && sudo apt-get install cloudflared
# check installed version
cloudflared --version
Then authenticate:
cloudflared tunnel login
On a desktop this opens a browser window; on a headless Pi it prints a URL to open on any other device. Log in, select the zone to add the tunnel to, and click Authorize; cloudflared then writes a cert.pem credential to ~/.cloudflared/.
cloudflared tunnel create raspberrypi
cloudflared tunnel info raspberrypi
tunnel create registers a named tunnel with Cloudflare and writes a credentials JSON to ~/.cloudflared/<Tunnel-UUID>.json. Keep that UUID to hand; you’ll need it in the config file.1
Cloudflare recommends creating the Access application before routing DNS to the tunnel, so the endpoint is protected from the moment it becomes reachable. (The Zero Trust dashboard is now branded Cloudflare One; the section names below have been stable, but expect the navigation to drift.)
From the Cloudflare dashboard go to Zero Trust (Cloudflare One) → Integrations → Identity providers → Add new identity provider to configure how users authenticate. A few options I’ve found useful:
https://<your-team-name>.cloudflareaccess.com and the authorisation callback URL to https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback, then copy the Client ID and Client Secret into the Zero Trust GitHub IdP form.For an extra layer on top of the IdP, go to Zero Trust → Access controls → Access settings → Allow multi-factor authentication (MFA) and enable MFA methods (e.g., Biometrics to use Passkeys), then tick Apply global MFA settings by default to enable MFA on all Applications and Policies.
Go to Zero Trust → Access controls → Applications → Create new application → Self-hosted and private.
raspberrypi-ssh.yourdomain.com) and a second for the test hostname used in the tunnel config below (e.g. raspberrypi-test.yourdomain.com). Anything the tunnel exposes without an Access destination is reachable by the whole internet; an application supports up to five.Add an Access policy with the inline builder, e.g. scoped to the emails that should have access (the selector is called Emails, plural):
| Action | Rule type | Selector | Value |
|---|---|---|---|
| Allow | Include | Emails | you@email.com |
Name and save the policy. The default session duration is 24 hours, so expect to re-authenticate daily unless you change it.
Create ~/.cloudflared/config.yml:
tunnel: <Tunnel-UUID>
credentials-file: /home/pi/.cloudflared/<Tunnel-UUID>.json
ingress:
# SSH traffic routed to port 22 (default)
- hostname: raspberrypi-ssh.yourdomain.com
service: ssh://localhost:22
originRequest:
# Validate Cloudflare Access JWTs before forwarding to the origin.
# This rejects traffic that bypasses the Access application.
access:
required: true
teamName: <your-team-name>
audTag:
- <Access-application-audience-tag>
# test HTTP/S server to validate tunnel connection
- hostname: raspberrypi-test.yourdomain.com
service: hello_world
originRequest:
access:
required: true
teamName: <your-team-name>
audTag:
- <Access-application-audience-tag>
# catch-all 404
- service: http_status:404
originRequest.access block tells cloudflared to validate the Cloudflare Access JWT on every inbound request before forwarding it to the origin, so even traffic that reaches the tunnel while bypassing the Access layer is rejected.access block must sit under each individual ingress rule. Despite what the docs suggest about top-level originRequest settings, a top-level access block is silently ignored and unauthenticated traffic is forwarded anyway (verified with 2026.7.1). Full explanation in cloudflared#784 and cloudflare-docs#32006.http_status:404 at the end is required.Validate the config and dry-run a rule:
cloudflared tunnel ingress validate
cloudflared tunnel ingress rule ssh://raspberrypi-ssh.yourdomain.com
cloudflared tunnel route dns raspberrypi raspberrypi-ssh.yourdomain.com
cloudflared tunnel route dns raspberrypi raspberrypi-test.yourdomain.com
This automatically creates CNAME records in your Cloudflare DNS zone pointing at the tunnel.
Before installing anything as a service, run the tunnel in the foreground:
cloudflared tunnel run raspberrypi
Within a few seconds the log should show several Registered tunnel connection lines. Then visit https://raspberrypi-test.yourdomain.com in a browser: after the Access login you should see the built-in hello world page (“Congrats! You created a tunnel!”) served from the Pi.
If the test behaves oddly in the first minute: a bare 403 means the Access application hasn’t propagated to the edge yet and the per-rule access block is rejecting the request itself (defence-in-depth doing its job); a 404 means the hostname fell through to the catch-all rule, so check the hostnames in config.yml match the DNS routes.
Stop the foreground tunnel with Ctrl+C before the next step.
sudo cloudflared --config ~/.cloudflared/config.yml service install
This copies the config to /etc/cloudflared/config.yml and enables and starts a systemd service, so no separate systemctl enable/start is needed. Check it with:
systemctl status cloudflared
The explicit --config matters: under sudo, cloudflared searches root’s config locations and won’t find files in your home directory. (The shell expands ~ before sudo runs, so the command above passes the right path.)
The credentials JSON stays in /home/pi/.cloudflared/; future config edits go in /etc/cloudflared/config.yml, followed by:
sudo systemctl restart cloudflared
Install cloudflared on the machine you’re connecting from (Mac: brew install cloudflared), then configure cloudflared as proxy in ~/.ssh/config:
Host raspberrypi-ssh.yourdomain.com
ProxyCommand cloudflared access ssh --hostname %h
(cloudflared access ssh-config --hostname raspberrypi-ssh.yourdomain.com prints exactly this block, with the absolute path to the binary filled in.)
Then connect as normal:
ssh pi@raspberrypi-ssh.yourdomain.com
The first connection opens a browser window for Cloudflare Access authentication (and SSH prompts you to accept the Pi’s host key as usual); once authenticated, the session completes in the terminal. Subsequent connections within the Access session duration are seamless.
Pro Tip: if cloudflared isn’t on your $PATH when SSH runs the ProxyCommand, use the absolute path: run which cloudflared and substitute the result.
The end result is a Pi that’s reachable from anywhere, with no open ports on the router, no public IP dependency, and an identity-gated access layer with MFA that starts with the Pi on every boot. (Yes, I rebooted it to check.)
cloudflared tunnel info raspberrypi shows the UUID alongside any active connectors. You can also find it in the filename of the credentials JSON under ~/.cloudflared/. ↩
There’s also an accessible PDF (using handwriting recognition).
]]>Getting from the airport to the campus was a rude awakening that my extremely basic Mandarin (nĭ hăo) wasn’t going to get me very far in China. Robert Burns wasn’t wrong when he wrote about the best-laid plans going awry—that’s exactly what had happened with my grand ideas to learn Mandarin before departing.
Once on campus, and after a few magical mystery tours to buy basic necessities and get internet access working—no, family and friends, I hadn’t fallen off the face of the earth, I just didn’t have WiFi yet—it was time to meet the rest of my group. Over mung bean smoothies (think mushy peas, but cold) we introduced ourselves and got to know each other and our teaching assistant.
Before long we had our first challenge, and it was a bombshell—we were expected to put on a group performance at the opening ceremony. After much deliberation, a consensus was reached that about the only thing we could manage would be a song, and the choice of Justin Bieber’s Baby was made. Apparently that’s the closest thing to a culturally universal song out there.
After the mild trauma of the opening ceremony the next day, it was time to settle into the summer school proper. A mixed schedule of lectures, field trips and cultural experiences would keep us busy for our two weeks at Tsinghua, with a group project at the end to bring things to a close.
The diversity of speakers reflected that of the students, with their lectures covering scientific and policy-based approaches to tackling environmental issues. These included membrane reactors for water treatment, operating international conventions through the UN, ‘blue-green solutions’ for city resilience and financing models to support environmental action worldwide.
Life at Tsinghua is very different to Imperial. For one thing, the campus is huge—it’s no surprise bikes are the most popular way to get around. Most students live in dormitories and eat at the many cafeterias dotted around the campus. With all the food labelled in Chinese, dinner roulette became a daily pastime. It was all tasty though, and undeniably cheap.
Seeing the sights around Beijing during field trips and free time was a particular highlight. Our brilliant teaching assistant was really keen to show us around, and we had some great times together, wandering through an ancient hutong before dining at a tiny Szechuan restaurant, stumbling across a karaoke night in Wudaokou after a group meeting, sampling traditional deserts in Wangfujing, exploring the Temple of Heaven before watching night fall over Houhai lake, joining the 80,000-strong crush of people visiting the Forbidden City each day, getting lost in the Summer Palace and having to dash for the last ferry across the lake, and soaking up the atmosphere of the Olympic Park by night.
One of the most valuable aspects of the experience for me was the wonderful people I met. There’s nothing quite like the bond you form when working on a group assignment together at 3 am, slightly delirious from exhaustion, or indeed from the bike ride back across campus at 4. We shared loads of great experiences with students from across the world, and it was fascinating to learn about the culture and environmental challenges of peoples’ countries. It’s not often you’ll find a group of young people getting deep into conversation about the solid waste management systems in their homelands. Perhaps unsurprisingly, that’s the topic we ended up picking for our group project.
I’m sure there’s never been a more important time for chemical engineers to be addressing environmental challenges. The breadth of industry we can impact gives us a unique position from which to drive positive change. I left Tsinghua confident that the future is bright.
This experience was supported by scholarships from Tsinghua and Imperial, for which I’m very grateful. This post has also been published on the Department of Chemical Engineering blog.
]]>This is where lecturers interact with students—from presentation slides and discussion fora to past papers and online submissions, so much happens through Blackboard. The Updates and My Grades views are particularly useful for keeping track of things.
I’m not exaggerating when I describe Todoist as “the dashboard to my life”. I put everything in this task manager, because it’s so easy to forget when you’re juggling lots of commitments. Tasks can be organised by project (I have one for each course), priority, tag, due date and with more complex queries using filters. The education discount makes it incredibly good value too!
Pro Tip: enable the Google Calendar integration to see the day’s tasks in your calendar, then drag them out from the ‘all day’ section to make a schedule for the day.
All my files are stored in OneDrive, synced between my personal MacBook and university laptop. The iOS app’s integration with the system-wide document picker makes it really easy to access files on the go as well.
I decided at the beginning of the year that every bit of paper in a ringbinder would have a digital duplicate in OneDrive. I did have to spend time scanning documents (love ADFs), but it was useful in the end.
The better way of collaborating in a team—set up a Team Site or a Group to provide file storage and collaboration tools. Because it’s not in any one member’s personal OneDrive, it doesn’t matter if members come and go.
Pro Tip: use the built-in document revision history to resolve any edit conflicts.
The usual suspects. Favourite features this year include PowerPoint Designer (though be careful of its foibles) and Excel’s Solver for things like double-interpolation. Visio can manage simple P&IDs (pretty important for a chemical engineer) with its built-in symbol library for both European and American standards.1
Pro Tip: create a custom wiggly line style to represent flexible connections correctly under ISO 14617-3:2002.2
Being in the right place at the right time is pretty useful, even in the age of lecture recordings!
Pro Tip: if you’re syncing timetable information from an external system, iOS will learn the meaning of event locations like ACEX 250 - Lecture Theatre 1 over time, allowing it to alert you when it’s time to leave.
For power features beyond your default PDF reader, Acrobat is the answer. It’s got more advanced markup tools, and things like digitally signing PDFs using my university-issued cryptographic identity make me especially happy.
This time-tracking utility logs how I use my computers and gives me a productivity score each day. The weekly summary email provides a nice overview of how I spent my time—and there’s no hiding from the statistics! Expect to be motivated to increase your score.
The time tracking continues—but with Toggl you log hours yourself. I’ve used it to track how long I’m spending in lectures, working on problem sheets and revising content. It’s nice to know that you’ve achieved a good week’s work when you get home on Friday evening.
Having reached the limits of what Quizlet (below) could manage last year, Studies has proven to be more than capable of doing everything I wanted. Notes don’t just have 2 sides—now they can have unlimited facets. The choice of algorithms provided by the built-in study scheduler is also pretty clever.
Pro Tip: get the free iOS app and sync your notes for offline access—now you need never be bored on the Tube again!
For simple notes, Quizlet is still great. I’ve used it in particular for foreign language vocabulary, since its fuzzy matching can cope with acceptable similar answers—such as the interchangeable use of “le / un” in French.
For graphing functions and playing around with variables, Desmos is great. Whether it’s wavefunctions or Fourier series, adjusting and animating variables using its sliders is a fun way to make complex functions easy to understand.
A “computational knowledge engine”. Useful.
It’s particularly good at obscure unit conversions (just give me SI, please!), computing nasty limits and integrals and plotting functions that Desmos can’t handle. There are some fun bits too!
Ever wondered just what that medicine looks like? MolView allows you to explore molecules in 3D, play with structure and view spectroscopy data—or you can just put some atoms and bonds on the page and see what you get. Particularly useful for organic chemistry.
A neat bilingual dictionary, available for loads of languages.
Pro Tip: the verb conjugator (available for some languages) is great for things like irregular subjunctives in French.
A useful reference manager, with PDF storage and annotation. Save journal articles to your library and use the iOS app to read, highlight and comment on the go. Another great app for long tube journeys, though the Mac version is desperately in need of a facelift.
Pro Tip: use the BibTeX export to reference with ease when writing LaTeX documents.
For an easy way into LaTeX it’s hard to beat ShareLaTeX,3 which is web-based so requires no installation. The knowledge base also contains loads of guidance for new users.
Pro Tip: sync your documents to GitHub for full version control.
MATrix LABoratory. Not only can it handle lots and lots of matrices very well, but it also does things like machine learning! It’s brilliant for manipulating large datasets much more easily than with Excel, plus the ability to make perfectly-consistent and infinitely-customisable graphs is really handy.
Pro Tip: learn how to use the print command to generate PDFs of your graphs automagically.
I’ve only scratched the surface of what this chemical drawing package can achieve, but it’s made me some very pretty 2D structure diagrams. Its tools for converting between name and structure are pretty helpful too.
I’ve been experimenting with automating my document filing process within OneDrive using this handy utility. I haven’t had time to explore everything it can do, but I’m keen to learn more about how to make the most of it.
The big plan for next year is to become paperless-–at least for lecture notes—using one of the budget-friendly new iPads with an Apple Pencil. This should reduce the amount of scanning I have to do, and make the content of the notes even more accessible to search (there’s only so much you can do with OCR…). Problem sheets will probably stay paper-based though.
AutoCAD Plant 3D is the ‘proper’ way of doing a P&ID, but I’ve been too busy to learn how to use it. Next year maybe! ↩
ShareLaTeX was acquired by Overleaf (another LaTeX-in-the-browser service) just under a year ago. I’ve used both and prefer the editor in ShareLaTeX, which thankfully will survive going forwards as part of Overleaf v2. ↩
I’ve only made notes for points in the specification that I wasn’t confident of, so there are omissions. I did err on the side of caution though, which means there’s quite a lot of content.
I’ve made a folder for each course in which you’ll find a set for each of the specification topics.
There are a couple of mistakes in the images which I’ve tried to remedy in the text. Remember that your teachers and textbooks are much more likely to be correct if there’s a conflict with what my notes say.
Don’t forget that you can copy and edit the sets as well. Happy studying!
Do note that whilst long-term learning is only available to paid Quizlet Plus members, the new learn mode replicates many of its features. This is what Quizlet says…
With Learn, Quizlet builds you an adaptive study plan based on what you need to study and how well you know the material, adjusting questions to make your study sessions harder or easier based on your study patterns. Learn is powered by the new Quizlet Learning Assistant platform, which uses machine learning to process data from millions of anonymous study sessions, and then combines that data with proven techniques from cognitive science.
…which sounds pretty similar to…
Long-term learning … tracks what you know and don’t know, and you get reminders to study at regular intervals. Questions you don’t will be repeated more frequently so you can focus on learning them. If you know the material, you’ll only see it every once in a while.
If you don’t need the other features of Quizlet Plus, you’ll probably be just fine with the new learn mode. ↩
Notice the diffraction of the waves around the small islands in the bottom left? Here’s a closer look:
Whilst it’s not exactly news to anyone that waves diffract, I thought it was incredibly cool to see such an impressive example of the phenomenon in nature.
Doing some more digging, it seems that the crew of Apollo 7 took a similar image (frame AS7-4-1607 of Magazine N) during their mission. Sadly, it doesn’t seem like any of the frames from that magazine have been digitised. The only other references are in a scientific paper (§ 2.5 Space Photography) where the image is completely unintelligible and in a picture book digitised by the Internet Archive which doesn’t seem to be at a high enough resolution to see the pattern.
In any case, one diffraction pattern is exciting enough!
]]>