Working notes

Cloudflare notes

Three guides for getting something of your own onto Cloudflare — a service on a machine you run, a private address on your LAN, or code with no machine behind it at all.

  1. Cloudflare Tunnel Runbook

    Publishing a private application from a Debian server through a tunnel, with Cloudflare Access in front of it. Dashboard-first, ordered so the app is never briefly public. Includes Cloudflare Mesh as an alternative route.

    DebiancloudflaredAccessMesh

  2. Tunnel or Mesh

    A worked example reaching one app at 10.0.1.20:8000 two ways — published to the internet behind Access, or kept entirely private on a mesh. Same endpoint, very different exposure.

    LANCIDR routesGateway policyaddressing

  3. Cloudflare Workers Runbook

    Create, deploy, route and protect a Worker. Code that runs at the edge with no origin machine — the counterpart to the first two, and the wrong tool for software that already runs somewhere.

    Wranglerbindingscustom domainsecrets

Which one you want

already runs on a machine Tunnel — publish a hostname, put Access in front.
no authentication of its own Mesh — keep it off the public internet entirely.
not HTTP Mesh — any TCP, UDP or ICMP, with long-lived connections intact.
you are writing it yourself Worker — nothing to host, nothing to patch.