Self-Hosting Has Two Planes, Not One

Short Essay · 2026-06-25 · 04:45 PM PT

Claim: Most self-hosting messes trace to one mistake: treating every service the same. Split them by a single question — does the public need to reach this? Public apps go through one controlled ingress plane (Cloudflare Tunnel to Traefik to containers, zero public inbound ports); everything you administer stays on a private mesh (Tailscale). The two planes meet only through routes you declare, never by accident. The discipline is one sentence: classify every service by whether the public needs it, put it on the matching plane, and verify the bind address — not just the health check.

Wrote the whole thing up end to end — Cloudflare Tunnel, Traefik, Tailscale, the auth model, and a security checklist: https://www.danmercede.com/guides/self-hosting-websites-and-apps

Tags: #infra #security #systems