RECHER_
THE LAB

One box, nothing listening.

Every public service reaches the lab through a single outbound-only Cloudflare Tunnel — the router forwards no ports, and this site isn't served from here at all.

TOPOLOGY

Request path

VisitorCloudflare edgeonly public surfaceThis sitestatic · served at edgeHomelab — Docker hostreached only by the outbound tunnelMedia appsRequestsAutomationTranscodeStorageSlack alertsoutbound tunnel
HOW IT STAYS UP

Boring on purpose.

Compose files, an environment template, and every custom script live in a repo that doubles as the rebuild guide.

  1. 01Cloudflare Tunnel publishes services. No port forwarding.
  2. 02Sensitive traffic is isolated in its own VPN network namespace.
  3. 03A socket proxy allow-lists the Docker API calls tooling may make.
  4. 04A watchdog restarts stalled services. Cron throttles heavy jobs.
  5. 05A daily Slack digest reports health, usage, and changes.