What stays outside the repo.

the zone

A domain on Cloudflare. Every published app is exactly one label under it, so one wildcard certificate covers the fleet and no per-app DNS work exists.

the tunnel

Created once via the API. Cloudflare returns the tunnel secret only in the creation response, so the dashboard wizard can't be used. Ingress is locally managed from the rendered config; editing it in the dashboard does nothing. The credential rides sops-encrypted in the config repo, which is the whole backup.

synced CNAMEs

One proxied CNAME per published app, upserted and swept on every rebuild. Any record pointing at the tunnel that isn't declared gets deleted. The repo owns this class of record; the dashboard doesn't.

hand-made records

Anything you point elsewhere yourself: a dynamic A record for a raw game port, a CNAME for a static site. Keep them DNS-only (grey cloud) and on a hostname no app declares, or the sweep will overwrite them and the proxy will swallow the port.

the API token

One token for everything Cloudflare on the box. Zone › Zone › Read and Zone › DNS › Edit cover the proxy's DNS-01, the route sync, the dynamic address and the control plane's domain picker; Account › Cloudflare One Connector: cloudflared › Read covers its tunnel panels. Include all zones and a domain added later shows up without touching the token. Stored once, so rotating it is one edit. Losing it is an outage, not data loss.

DNS-01, pinned upstream

Challenges resolve against 1.1.1.1 directly. The LAN's own resolver can't see a fresh TXT record, and waiting on it would time every renewal out.

the cert store

Not in any backup tree. It reissues itself from nothing, but Let's Encrypt rate-limits duplicates, so copy it aside before risky disk work.

what gets forwarded

Only protocols that can't ride the tunnel: a WireGuard endpoint, a game server. No TLS means no SNI for a proxy to route on, and no tunnel client inside a game launcher.

DHCP: off

The box's DNS server is also the LAN's DHCP server, so the router's must be off. The box itself boots on a static IP, since there'd be nobody to lease from that early.

everything else: closed

SSH, HTTP, DNS and the database are LAN-only. Port scans from the internet die at the router; public traffic exists only inside the tunnel.

the config repo

Private. It holds the machine: every stack, every sops-encrypted secret, and the ledger of what's outside it. A deploy SSH key, its public half registered by hand in account settings, authenticates the weekly autoupgrade push.

one repo per app

Each app is a repo. A push to main reaches the box as a webhook, which builds the image on its own hardware (Railpack, unless the repo has a Dockerfile and no railpack.json) and pushes it to the box's registry, then starts the app's deploy.

the box's own GitHub App

Created and installed from the control plane. Its private key is sealed into the config repo and stays host-side; the container only ever sees a one-hour installation token, scoped to reading contents and Actions runs and writing checks and deployments.

Pages

This site. Built by Actions, custom domain set once in the repo's Pages settings, paired with a hand-made grey-cloud CNAME in the zone.

↳ .github/workflows/website.yml

one app password

Two-factor on, app password issued once. Consumed by the system sendmail, the dashboards, the dead-man switch and anything else that needs to reach you.

the honest footnote

The box resolves DNS through itself, so an alert about the resolver being down cannot leave the box. Known and accepted.

the age recovery key

Every secret in the config repo decrypts for exactly two identities: the box's SSH host key, and your personal age key, whose password-manager copy is the recovery of last resort. Lose both and the repo's secrets are ciphertext forever; every provider relationship above gets rebuilt by hand.

the identity provider's encryption key

One environment variable encrypts the identity provider's signing keys at rest. Set it once and treat it as fixed. Rotating it means re-encrypting everything it protects; losing it means every session and every app registration starts over.

passkeys

The identity provider's first boot is interactive: an admin account and a passkey, registered once. The passkeys on your devices are the credential; the last resort is a one-time token minted from a shell on the box.

after rotating a secret

A rebuild alone is the false success: rendered copies keep serving the old value. Restart the render unit and its consumer, by hand, every time.

after importing a fresh pool

Child datasets are not auto-created. Each one is a one-time create. The repo lists every child; the pool doesn't.

after losing the box

Images live only in the box's own registry, so every app needs one build before its first deploy on new hardware.