Home-lab behind a Cloudflare Tunnel
Outbound-only exposure for services on a Pi behind CGNAT — with Access-gated private notes
My home Raspberry Pi runs real services — this site's notes garden, the Mooncat combo app, and friends' projects — but the connection is CGNAT'd and the router admin password is long lost. I can't open a port even if I wanted to. I needed a way to put some services on the public internet with proper HTTPS, and keep genuinely private ones (my notes) behind a login wall, without touching the router at all.
- 01One `cloudflared` tunnel process on the Pi (a Cloudflare Tunnel) opens an outbound-only connection to Cloudflare's edge — zero inbound ports, NAT-proof, and it hides the home IP. No router config needed.
- 02Routes are configured remotely in the Cloudflare dashboard: each public hostname maps to a local port. One tunnel serves many services.
- 03The notes garden is protected with Cloudflare Access (email one-time-password), so only I get past the login wall; the Mooncat app is public.
- 04Runs as a user systemd unit with restart-on-failure, so the tunnel survives reboots and ISP blips without root.
- 05SSL is automatic (Cloudflare terminates TLS at the edge); origin talks plain HTTP over the encrypted tunnel.
Services on a CGNAT'd Pi are reachable at real hostnames with HTTPS and per-hostname auth — private notes behind an OTP login, public apps open — all outbound-only, no router access, on the free tier. Adding a future service is just another route entry in the dashboard.
Port forwarding was off the table entirely — CGNAT plus a lost router password. A Cloudflare Tunnel is outbound-only, so it works behind any NAT and never exposes the home IP.
The notes garden contains genuinely private material (career lessons, previous-employer architecture). Cloudflare Access gives a shareable email-OTP login with zero application code — the private pages never need their own auth logic.
The Pi has no passwordless sudo. Running cloudflared as a user unit (with linger enabled) keeps it alive across logout and reboot without elevating privileges.