Why#
There is an inherent tension in building privacy infrastructure and then connecting it to the internet. The entire premise of HomeStack is that your data stays yours — that no company sits between you and your family’s files, photos, and passwords. And then you spend a weekend configuring Cloudflare to relay traffic to your server.
This is not hypocrisy. It is a trade-off, and trade-offs need to be named.
The alternative to a tunnel service is opening ports on your home router — publishing your home IP address, managing firewall rules, accepting that every port you open is a surface that needs defending. For a family server with no dedicated security team, that is a worse trade-off. Cloudflare sees the domain names. They do not see the content, because TLS terminates on your side. You accept the metadata exposure in exchange for not exposing your home network.
I wrote a decision record for it. I still think it was the right call.
Family#
The moment Vaultwarden loaded on my phone over mobile data — not on the home network, not via a local IP, but from the actual internet — felt different from anything that had come before. The server was no longer a project in my home office. It was infrastructure.
I showed my partner. The password manager now works from anywhere. The reaction was more interested than before. Less “what is it” and more “so I can use this when I’m not home?” Yes. Exactly that.
That question — can I use this when I’m not home — is the real acceptance test. Not a benchmark, not a security audit. Just: does it work when the person who built it isn’t in the room to fix it?
Tech#
Phase 2 has two separate access paths, and keeping them separate was a deliberate architectural choice. Cloudflare Tunnel handles user-facing services: Vaultwarden and Authentik, reachable at their public URLs. Tailscale handles administration: SSH access to the Pi over a WireGuard mesh, visible only to devices I control. One path for the family. One path for me.
The Root CA came first. A ten-year certificate authority, private key stored in Vaultwarden and nowhere else reachable from the network. The key is what makes E2E encryption possible — it is what allows me to eventually tell Cloudflare to verify the origin certificate rather than trust blindly. In this phase, that step was deferred. noTLSVerify: true is a documented debt, not a forgotten shortcut.
The tunnel had a problem. The first version had two connectors — one from a package install I had removed, one from the Docker container I had replaced it with. Cloudflare was distributing traffic between them. The old connector could not handle requests. The fix was to delete the tunnel entirely and start over. The lesson was that cleanup in infrastructure is not optional. Ghosts of old configurations do not disappear; they just fail silently until they fail loudly.
Grafana was the final piece. Node Exporter, Prometheus, Grafana — three services that exist only to tell you what the other services are doing. CPU temperature, memory, disk usage, container uptime. The Pi runs warm but well within limits. I now know this with numbers, not intuition.
Project#
Three days. One token accidentally pasted into a chat window — tunnel deleted, new token generated, lesson learned about where credentials end up when you’re moving fast. A Prometheus container that crashed on first start because the data directory was owned by root. A Grafana browser tab that wouldn’t load because the hosts file on the laptop was still pointing at an old VPN address from a different project entirely.
None of these were serious problems. All of them were the kind of problem that doesn’t appear in tutorials — the accumulated friction of real environments, where old configuration follows you around like luggage you forgot to unpack.
Monitoring is always the last thing people build and the first thing they wish they had built earlier. I understand why. It produces no visible output for users. It generates no features. It just sits there, quietly collecting numbers, until the moment when those numbers are the only thing standing between you and a three-hour debugging session. Phase 2 is done. The door is open. The cameras are on.