Homelab Cloudflare Tunnel Stack

Escape CGNAT Without Opening a Single Port

You're behind CGNAT or a restrictive ISP. Port forwarding doesn't work. Your dynamic IP changes every reboot. You don't want SSH open to the internet.

This stack runs Cloudflare Tunnel—a lightweight daemon that creates an outbound-only connection from your homelab to Cloudflare's edge. Public traffic flows through the tunnel to your private services. Your real IP never appears in DNS. Zero inbound ports means zero attack surface.

What Is Included

• docker-compose.yml — Production-ready Compose with both credentials-file and token modes, health checks, and optional metrics endpoint
• config/config.yml — Pre-tuned ingress rules for 6 services with per-service originRequest settings (websockets, timeouts, headers, chunking)
• Six Services Preconfigured — Jellyfin (video), Nextcloud (sync), Home Assistant (automation), Uptime Kuma (monitoring), Gitea (git), Vaultwarden (passwords)
• Home Assistant Configuration Snippet — Copy-paste trusted_proxies setup for header forwarding
• Security Section — Cloudflare Access integration guidance for admin endpoints
• .env & .gitignore — Safe credential handling (prevents accidental commits)

How It Works

Create a Cloudflare Tunnel, generate credentials, drop them into this stack. Configure DNS routes (one command per service). Start the Compose file. Your services are instantly available at service.your-domain.com with HTTPS.

No port forwarding. No dynamic DNS. No exposing SSH. Cloudflare handles DDoS, SSL termination, and geographic routing. You own the infrastructure-as-code: ingress rules live in config.yml, not locked in a dashboard.

What You Get Immediately

• Working remote access to all 6 services (comment out the ones you don't use)
• HTTPS everywhere (Cloudflare cert, no self-signed mess)
• Per-service tuning for websockets, chunked uploads, header forwarding
• Comprehensive README with service-specific setup, networking patterns, troubleshooting
• Token mode documented if you prefer remote-managed config
• Security best practices (Cloudflare Access recommendation for sensitive endpoints)

Requirements

Cloudflare account (free tier works). Domain registered or transferred to Cloudflare nameservers. Docker & Docker Compose. The services running on your network (or comment out unused ones). That's it. Rest is turnkey.