Host: cloudflare — Ingress (cloudflared), Static Sites and LAN DNS

Role: the network's only ingress, and the origin for the static web properties. LAN address 192.168.5.50. The SSH alias cloudflare names the host's function, not the company.

cloudflared on this host proxies all public traffic into the internal network. No other host has an internet-facing port. The rules a service must follow behind it are in Home Lab Fleet and Ingress.

What runs here

• cloudflared: the tunnel connector for every public hostname, not just for the nginx on this host.
  • It forwards plain HTTP to origins across the LAN. For example, jakefear.com goes to http://docker2.lan:8082.
  • The web tunnel (jspwiki) is remotely managed, so routes are edited in the Cloudflare Zero Trust dashboard. /etc/cloudflared/config.yml is a shadow copy that cloudflared ignores.
  • Origins receive the request's Host header unchanged, plus CF-Connecting-IP, X-Forwarded-For and X-Forwarded-Proto. The TCP peer they see is 192.168.5.50.
• nginx on :8000: docroot /var/www/www.wikantik.com, serving the static marketing site, www.wikantik.com. The apex wikantik.com resolves to www through a proxied CNAME.
• Pi-hole: LAN DNS. It is the only resolver that knows the <host>.lan names.
• SSH jump host.
• jakemon Alloy agent: fleet monitoring. jakemon also watches cloudflared itself: the CloudflaredConfigChanged alert fires on every route change (IncidentCloudflaredConfigChanged), public vhost reachability (IncidentEdgeVhostDown), TLS certificate expiry (IncidentTLSCertExpiringSoon), and Pi-hole DNS resolution (IncidentPiholeDnsDown).

How the marketing site is deployed

The marketing site's source of truth is the wikantik repo's marketing/ directory; it has no build step. bin/deploy-marketing.sh:

1. rsyncs an allowlisted web bundle to an unprivileged staging directory (~/wikantik-deploy/site);
2. copies it into the docroot under interactive sudo. The host's sudo is not passwordless, so a human must run this step, for example ! bin/deploy-marketing.sh inside a Claude session;
3. chowns it to www-data:www-data and verifies it on the origin through :8000.

Dev-only files (form-helper.mjs, test/, form-backend/, READMEs) are excluded by the allowlist and never reach the docroot. Full conventions: Marketing Site Operations.

Gotchas

• Agents cannot complete a deploy alone. The sudo prompt is interactive by design: stage the changes and hand the deploy command to the human.
• Outbound wiki links on marketing pages must be in marketing/verified-wiki-links.json, added only after a live 200 check.
• A new tunnel route is a dashboard change, not a file change, and it trips CloudflaredConfigChanged. That is expected.

See Also

• Home Lab Fleet and Ingress: the fleet, LAN DNS, and the rules for services behind this host
• Marketing Site Operations: page conventions, templates, and the link allowlist
• Home Lab Infrastructure Hub