Project Helix: Removing the friction from Cloudflare One onboarding

Cloudflare One is a broad SASE platform, and its breadth is both its strength and its challenge. Because the platform is composable, product teams release capabilities independently, which means a new tenant often comes with many advanced features disabled by default. For an administrator, that "blank slate" can turn into hours of manual policy creation, configuration tweaks, and troubleshooting before the platform is fully operational.

To address this, Cloudflare has built Project Helix, an internal tool that codifies best practices from its Solutions Engineers and Professional Services teams into automated Terraform templates. The result is a way to provision a full-featured Cloudflare One tenant in minutes, rather than days.

The configuration bottleneck

Even with products designed to simplify complex networking concepts—such as Magic WAN, Magic Transit, and Network Firewall—Cloudflare One still requires deliberate setup to achieve optimal outcomes. Default configurations are intentionally conservative to avoid disrupting existing traffic, which is sensible for migrations but creates a tedious process for greenfield deployments.

This tension was visible in a recent example. Cloudflare released a capability to connect and secure any private application by hostname, but enabling it required more than flipping a switch. The default split tunnel configuration had to be modified to send a specific CGNAT range through the Cloudflare One Client. That change could break existing environments, so it couldn't simply become a global default. Customers were left to figure out the extra steps themselves.

Guides and scenario-based wizards helped, but they had limitations. A customer who wanted to adopt all four scenarios in the "Get Started" guide had to step through each wizard individually, and the approach still didn't ensure consistent outcomes across different deployments.

Turning expertise into repeatable code

The core problem was knowledge transfer. Cloudflare's Solutions Engineers, Professional Service Engineers, and partners had accumulated vast expertise from production deployments, demos, and proof-of-concepts, but that expertise wasn't consistently accessible. The goal for Project Helix was to make sharing best practices as easy as pushing a button, in a codified format that eliminated manual error.

The team started by asking what an ideal proof-of-concept experience should look like and documented the desired outcomes:

  • Baseline security best practices across DNS, network, and HTTP protocols
  • TLS inspection and QUIC/HTTP3 security
  • Browser Isolation for risky categories, such as newly-registered domains
  • Visibility and controls for AI applications
  • Tenant Control policies to restrict users to their own SaaS instances (Office 365, Google Workspace, Dropbox, Box, etc.)

The team also addressed common pain points: allowing direct internet breakout for real-time communication apps like Zoom, and assembling a list of widely used captive portals from airlines and hotels so that the Cloudflare One client wouldn't interfere with users accessing private network resources while traveling.

The manual alternative—documenting every policy and step—was unsustainable. It would take hours per deployment, require constant documentation maintenance, and inevitably introduce human error.

How Helix works

Cloudflare's internal teams had already embraced Terraform to manage the growing number of accounts for internal users, so Project Helix built on that approach. The team architected scalable Terraform templates to deliver all the settings, configuration snippets, and policies. From there, they built a web-based interface hosted in Cloudflare Workers, leveraging Cloudflare Containers.

Users enter basic parameters into the UI, and it executes the Terraform templates ephemerally. No persistent storage is used, so there's no risk of logs or tokens from the provisioning process lingering. Within minutes, a tenant is configured with advanced security features and recommended policies. The same interface surfaces a list of security policies the customer can enable with a flip of the switch.

The resulting configuration includes preconfigured DNS policies for zero trust, blocking risky categories from resolving. Network policies protect users across all ports and protocols, while HTTP policies cover enterprise application tenant controls, AI prompt security, and isolation of risky domains. Because object names and interactions are templatized, the deployment can be internationalized to match Cloudflare's, which has been localized since 2020.

Deployments are optimized for interoperability with common captive portals and include an option to break out Zoom traffic to avoid the performance issues that come from tunnelling it.

Impact and rollout

For a Cloudflare One Solutions Engineer, using Helix for a proof-of-concept saved 2-3 weeks of start-up and prep time. The engineer was able to demonstrate all the essential Cloudflare One features to a customer within 15 minutes of deploying the Helix-based configuration. For customers, the benefit is straightforward: they can enjoy Zero Trust security from day one, without having to fight through a blank slate.