Tukuk-OSMy web server ran fine on an old computer at home, but it was only reachable on the local network. To share it with the world I had to solve two problems: a memorable address (a domain) and a way to bring traffic in without opening a hole in my firewall. Cloudflare Tunnel solved both, and the combination became the tukuk.org you visit today.
The Problem With the Traditional Way
The old way to host your own server is to buy a domain, point an A record at your home's public IP, and open ports 80 and 443 on your router. I tried it, and it failed at every step: my home IP changed, my internet provider blocked certain ports, and opening ports meant I had to keep my server's security perfect every single time.
My biggest fear was not being targeted — it was not knowing what I did not know. One wrong configuration and my private server could become part of a botnet. I wanted minimal exposure.
What Is a Cloudflare Tunnel?
A Cloudflare Tunnel runs a small agent on your server that reaches out to Cloudflare's network, rather than allowing inbound connections. No port is opened on the router, no IP needs updating, and traffic is encrypted the whole way.
When I ran cloudflared for the first time and received a temporary URL, I opened it on my phone outside the local network and saw my server. That feeling — seeing your work accessed from the outside world without opening a single port — was one of the most satisfying moments of this journey.
Setting Up tukuk.org
Once the tunnel worked I added my own domain. The steps: add the domain to a Cloudflare account, let Cloudflare manage DNS, then point a hostname at tukuk.org and subdomains like www. Within minutes https://tukuk.org was serving the server at my home, complete with automatic HTTPS certificates.
What I learned: DNS is a layered trust system. MX records for email, SPF to verify senders, DMARC to protect your domain name from being forged — all must be aligned. A small mistake in one record can put your email in spam folders for weeks.
Subdomains and Service Separation
Once the tunnel worked I decided to separate services with different subdomains. The main application server lives at tukuk.org, while supporting services like the indexer and background search workers stay on local ports that are never exposed to the public.
This separation gave me three advantages. First, security: only one service touches the internet, so I only maintain one attack surface. Second, changeability: I can restart background services without touching pages users see. Third, clarity: when something fails, the tunnel location tells me immediately which service is broken.
I also learned the value of a hidden robots.txt and a health page. robots.txt stops bots from wasting time indexing utilities, while /health gives a monitoring agent one simple URL that returns the system's true status. Two small files prevented a lot of confusion later.
When I add a new service the rule stays the same: if the public does not need to reach it, it gets no subdomain and opens no port. Expose as little as possible — that principle governs the entire Tukuk-OS network configuration.
Security: Layers I Added
With a public domain I added several layers: robots.txt to tell bots what may be accessed, rate limiting to prevent abuse, and basic monitoring. I also keep secrets in an .env file that never enters the git repository — a lesson I learned early before it became a problem.
I also decided not to expose Meilisearch (port 7700) to the internet at all. Only the application server talks to it over localhost. One simple rule — expose as little as possible — dramatically reduced my attack surface.
Cost and Limitations
I avoided big monthly bills, but I still have costs: an annual domain, and my time to maintain it. The tunnel itself is free for my needs. When traffic grows I will evaluate when to move to more solid hosting, and when a home server is still enough.
The biggest lesson: hosting is not a question of "expensive or cheap" but of "exposure and control". Cloudflare Tunnel gave me full control of my stack with minimal exposure to the internet — the combination I had been looking for since the day my server first came alive under a bed.