Notes on self-hosting behind a tunnel

9 October 2025

infracaddycloudflare

The shape of this setup, briefly:

1. Origin — Caddy binds 127.0.0.1 only and serves plain HTTP; it is not reachable from the LAN or the tailnet.
2. Edge — cloudflared holds outbound connections to Cloudflare; TLS terminates there, and HSTS is set at the edge.
3. Deploys — a self-hosted GitHub Actions runner on the Pi builds the site and copies the output into the web root with rsync.

The useful property is that nothing listens on the public internet. If the tunnel is down, the site is down, and the blast radius of a mistake is a directory of static files.

← Back to blog