Host: cloudflare — Static Sites and Tunnel Origin

Role: origin for the static web properties, fronted by Cloudflare tunnels. SSH alias cloudflare (the alias is the host's function, not the company).

What runs here

• nginx on :8000 — docroot /var/www/www.wikantik.com, serving the static marketing site (www.wikantik.com; the apex wikantik.com resolves via a proxied CNAME to www)
• cloudflared — the tunnel connector that exposes nginx to the internet without inbound ports
• jakemon Alloy agent — fleet monitoring

How it is deployed

The marketing site's source of truth is the wikantik repo's marketing/ directory (no build step). bin/deploy-marketing.sh:

1. rsyncs an allowlisted web bundle to an unprivileged staging dir (~/wikantik-deploy/site)
2. copies it into the docroot under interactive sudo (the host's sudo is not passwordless — a human must run this, e.g. ! bin/deploy-marketing.sh inside a Claude session)
3. chowns to www-data:www-data and verifies on-origin via :8000

Dev-only files (form-helper.mjs, test/, form-backend/, READMEs) are excluded by the allowlist and never reach the docroot. Full conventions: Marketing Site Operations.

Gotchas

• Agents cannot complete a deploy alone — the sudo prompt is interactive by design. Stage the changes and hand the deploy command to the human.
• Outbound wiki links on marketing pages must be in marketing/verified-wiki-links.json, added only after a live 200 check.

See Also

• Marketing Site Operations — page conventions, templates, link allowlist
• Home Lab Infrastructure Hub