Cloudflare Tunnel Publishing
A Cloudflare Tunnel publishing environment used to provide selected self-hosted web services with public HTTPS access while keeping the underlying management infrastructure private.
Project Goal
The goal of this environment is to publish selected self-hosted web services through a controlled Cloudflare path rather than exposing internal management interfaces directly to the Internet.
Cloudflare provides the public DNS and HTTPS edge while a dedicated cloudflared connector inside the Proxmox environment provides access to approved internal web services.
Public documentation intentionally excludes tunnel identifiers, connector identifiers, internal addressing, origin addresses, credentials, and private routing configuration.
Published Services
TLC Tech Lab Portfolio
TLCTechLab.com is published through Cloudflare with proxied DNS and HTTPS access to the self-hosted Nginx web service.
Community Nextcloud Service
The Greensburg Ghost Society Nextcloud environment is also securely published for remote member access while the underlying server and storage infrastructure remain private.
Canonical Website Address
The www hostname redirects to the primary TLCTechLab.com address with an HTTP 301 redirect.
Architecture
Technologies Used
What I Built
- Deployed a dedicated Linux container to run the Cloudflare Tunnel connector.
- Installed and maintain cloudflared as an enabled system service.
- Configured selected self-hosted services for public access through Cloudflare.
- Configured the portfolio domain to use Cloudflare-proxied DNS and HTTPS access.
- Configured the www hostname to redirect to the primary portfolio domain.
- Implemented HTTP security controls including HSTS on the public portfolio response.
- Maintain the publishing layer separately from the application workloads being exposed.
- Validated public service availability while keeping common infrastructure-management ports unreachable through the public hostname.
Security and Privacy Considerations
- Tunnel identifiers, connector identifiers, origin addresses, internal IP addresses, and credentials are not published.
- Only selected web services are intentionally exposed through the Cloudflare publishing path.
- Common management services including SSH, SMB, NFS, NAS administration, and the Proxmox management interface are not reachable through the public portfolio hostname.
- The public portfolio currently returns HSTS and additional HTTP security headers.
- The site returns an X-Robots-Tag containing noindex, nofollow, noarchive, nosnippet, and noimageindex.
- The web applications and the Cloudflare connector are maintained as separate workloads.
Operational Value
Cloudflare Tunnel provides a controlled publishing layer between public users and selected self-hosted web services while allowing the underlying infrastructure to remain private.
Separating public publishing from application hosting makes it easier to manage DNS, HTTPS, service routing, application workloads, and infrastructure-management access as distinct responsibilities.
The design also provides practical experience troubleshooting connectivity across multiple layers: public DNS, Cloudflare, the tunnel connector, the destination web service, and the application itself.
What This Demonstrates
This project demonstrates secure service publishing, DNS administration, HTTPS delivery, Cloudflare Tunnel operations, Linux service management, HTTP redirects, security-header validation, public-versus-private service separation, and multi-layer connectivity troubleshooting.
Project Status
Active and operational. cloudflared 2026.9.1 is currently running as an enabled service. TLCTechLab.com returns HTTP 200 through Cloudflare with HSTS and noindex protection, while the www hostname redirects to the primary domain with HTTP 301.