![\"\"](\"https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_1_1920x1080.png.png\")
<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n<\/figure>\n\n\n\nThe setup
Hardware: a repurposed old laptop
OS: Ubuntu Server
Web server: Nginx
Domain: a cheap domain purchased through Namecheap
DNS & tunneling: Cloudflare (free tier) + cloudflared<\/p>\n\n\n\n
The first deliverable was a landing page for the server itself \u2014 partly to have something real to test the pipeline against, partly as a bit of fun for the family. I built it as a static site (HTML\/CSS\/vanilla JS) with a playful, warm design, a live clock, and a couple of small interactive touches, themed loosely around our family name and our dog.<\/p>\n\n\n\n
Getting around CGNAT: Cloudflare Tunnel<\/h5>\n\n\n\n
Instead of exposing a port on my router, I installed cloudflared on the server. It opens an outbound connection from my server to Cloudflare’s edge network \u2014 since it’s outbound, CGNAT is a complete non-issue. Cloudflare then proxies public requests for my domain through that tunnel back to Nginx running on localhost:80.<\/p>\n\n\n\n
Stepps I have followed:<\/h5>\n\n\n\n\n- Point the domain’s nameservers at Cloudflare.<\/li>\n\n\n\n
- Install cloudflared on the Ubuntu server and authenticate it against my Cloudflare account.<\/li>\n\n\n\n
- Create a named tunnel (cloudflared tunnel create), which generates a tunnel ID and a credentials file.<\/li>\n\n\n\n
- Write an ingress configuration mapping a hostname to http:\/\/localhost:80<\/a>, with a catch-all 404 rule at the end.<\/li>\n\n\n\n
- Route DNS for the domain to the tunnel (cloudflared tunnel route dns) and install cloudflared as a systemd service so it survives reboots.<\/li>\n<\/ul>\n\n\n\n
A couple of real-world snags worth mentioning, since this is where most of the actual learning happened.<\/h5>\n\n\n\n
Ubuntu version mismatch in the package repo. My server runs a very recent Ubuntu release, and Cloudflare’s apt repository didn’t yet have a matching codename \u2014 apt update failed with a 404. The fix was to point the repo at the noble (24.04 LTS) codename instead, since cloudflared itself is a self-contained Go binary with no real dependency on the underlying distro version.
Conflicting DNS records. My domain registrar had already created a placeholder A record for a “parking page,” which blocked Cloudflare from creating the CNAME the tunnel needed. Deleting the stale record cleared the way.
sudo and home directories don’t mix well. Running cloudflared service install under sudo looks for its config under root’s home directory, not the user’s \u2014 so the config file I’d written to ~\/.cloudflared\/ was invisible to it. Moving the config and credentials file to \/etc\/cloudflared\/ (and updating the credentials-file path inside the config accordingly) resolved it.<\/p>\n\n\n\n\n![\"\"](\"https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_4_1920x1080.png-1024x576.png\")
<\/a><\/figure>\n\n\n\n![\"\"](\"https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_5_1920x1080.png-1024x576.png\")
<\/a><\/figure>\n\n\n\n![\"\"](\"https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_6_1920x1080.png-1024x576.png\")
<\/a><\/figure>\n<\/figure>\n\n\n\nLocking it down<\/h5>\n\n\n\n
A publicly reachable web server is one thing, a publicly reachable SSH port is another. Rather than exposing SSH directly, I added a second ingress rule to the same tunnel, on a separate subdomain, pointing at ssh:\/\/localhost:22. On top of that, I’m layering Cloudflare Access so that reaching the SSH hostname requires an authenticated login (e.g. a one-time email code) before the tunnel will even proxy the TCP connection through. Combined with key-based SSH authentication on the server itself, this keeps remote administration usable without leaving a bare port open to the internet.<\/p>\n\n\n\n
What this demonstrates? Small project, but it touches a handful of things that come up constantly in real IT\/infrastructure work:<\/h5>\n\n\n\n\n- Working comfortably in a Linux server environment via SSH, systemd, and apt<\/li>\n\n\n\n
- Understanding NAT, CGNAT, and why traditional port-forwarding breaks down<\/li>\n\n\n\n
- DNS management and troubleshooting (nameservers, record types, conflicting entries)<\/li>\n\n\n\n
- Reverse-proxy concepts and outbound-only tunneling as an alternative to inbound exposure<\/li>\n\n\n\n
- A basic zero-trust mindset: don’t expose services directly \u2014 broker access through an identity-aware layer instead<\/li>\n\n\n\n
- Debugging by reading error messages carefully and reasoning about why a tool behaves the way it does (e.g. sudo and $HOME), rather than guessing<\/li>\n<\/ul>\n\n\n\n
What’s next?<\/h5>\n\n\n\n
Now that the tunnel is stable, the plan is to add more services behind it \u2014 a dashboard, some self-hosted tools, and eventually a proper reverse-proxy setup with multiple subdomains, each routed through the same tunnel with its own access policy.<\/p>\n","protected":false},"excerpt":{"rendered":"
A small homelab project in networking and Linux administration. The problem Like a lot of home internet connections in Finland […]<\/p>\n","protected":false},"author":1,"featured_media":880,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-887","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":[],"mb":[],"uagb_featured_image_src":{"full":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png.png",1200,675,false],"thumbnail":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png-150x150.png",150,150,true],"medium":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png-300x169.png",300,169,true],"medium_large":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png-768x432.png",768,432,true],"large":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png-1024x576.png",1024,576,true],"1536x1536":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png.png",1200,675,false],"2048x2048":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png.png",1200,675,false]},"uagb_author_info":{"display_name":"NikoNmaki","author_link":"https:\/\/nnmaki.com\/index.php\/author\/nnmakicom2026\/"},"uagb_comment_info":0,"uagb_excerpt":"A small homelab project in networking and Linux administration. The problem Like a lot of home internet connections in Finland […]","mfb_rest_fields":["title","uagb_featured_image_src","uagb_author_info","uagb_comment_info","uagb_excerpt"],"_links":{"self":[{"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/posts\/887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/comments?post=887"}],"version-history":[{"count":7,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/posts\/887\/revisions"}],"predecessor-version":[{"id":897,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/posts\/887\/revisions\/897"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/media\/880"}],"wp:attachment":[{"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/media?parent=887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/categories?post=887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/tags?post=887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
A couple of real-world snags worth mentioning, since this is where most of the actual learning happened.<\/h5>\n\n\n\n
Ubuntu version mismatch in the package repo. My server runs a very recent Ubuntu release, and Cloudflare’s apt repository didn’t yet have a matching codename \u2014 apt update failed with a 404. The fix was to point the repo at the noble (24.04 LTS) codename instead, since cloudflared itself is a self-contained Go binary with no real dependency on the underlying distro version. A publicly reachable web server is one thing, a publicly reachable SSH port is another. Rather than exposing SSH directly, I added a second ingress rule to the same tunnel, on a separate subdomain, pointing at ssh:\/\/localhost:22. On top of that, I’m layering Cloudflare Access so that reaching the SSH hostname requires an authenticated login (e.g. a one-time email code) before the tunnel will even proxy the TCP connection through. Combined with key-based SSH authentication on the server itself, this keeps remote administration usable without leaving a bare port open to the internet.<\/p>\n\n\n\n Now that the tunnel is stable, the plan is to add more services behind it \u2014 a dashboard, some self-hosted tools, and eventually a proper reverse-proxy setup with multiple subdomains, each routed through the same tunnel with its own access policy.<\/p>\n","protected":false},"excerpt":{"rendered":" A small homelab project in networking and Linux administration. The problem Like a lot of home internet connections in Finland […]<\/p>\n","protected":false},"author":1,"featured_media":880,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-887","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":[],"mb":[],"uagb_featured_image_src":{"full":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png.png",1200,675,false],"thumbnail":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png-150x150.png",150,150,true],"medium":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png-300x169.png",300,169,true],"medium_large":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png-768x432.png",768,432,true],"large":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png-1024x576.png",1024,576,true],"1536x1536":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png.png",1200,675,false],"2048x2048":["https:\/\/nnmaki.com\/wp-content\/uploads\/2026\/09\/homelab_fi_1200x675.png.png",1200,675,false]},"uagb_author_info":{"display_name":"NikoNmaki","author_link":"https:\/\/nnmaki.com\/index.php\/author\/nnmakicom2026\/"},"uagb_comment_info":0,"uagb_excerpt":"A small homelab project in networking and Linux administration. The problem Like a lot of home internet connections in Finland […]","mfb_rest_fields":["title","uagb_featured_image_src","uagb_author_info","uagb_comment_info","uagb_excerpt"],"_links":{"self":[{"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/posts\/887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/comments?post=887"}],"version-history":[{"count":7,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/posts\/887\/revisions"}],"predecessor-version":[{"id":897,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/posts\/887\/revisions\/897"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/media\/880"}],"wp:attachment":[{"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/media?parent=887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/categories?post=887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nnmaki.com\/index.php\/wp-json\/wp\/v2\/tags?post=887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Conflicting DNS records. My domain registrar had already created a placeholder A record for a “parking page,” which blocked Cloudflare from creating the CNAME the tunnel needed. Deleting the stale record cleared the way.
sudo and home directories don’t mix well. Running cloudflared service install under sudo looks for its config under root’s home directory, not the user’s \u2014 so the config file I’d written to ~\/.cloudflared\/ was invisible to it. Moving the config and credentials file to \/etc\/cloudflared\/ (and updating the credentials-file path inside the config accordingly) resolved it.<\/p>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n<\/figure>\n\n\n\nLocking it down<\/h5>\n\n\n\n
What this demonstrates? Small project, but it touches a handful of things that come up constantly in real IT\/infrastructure work:<\/h5>\n\n\n\n
\n
What’s next?<\/h5>\n\n\n\n