RRREAZ ROMEN
← Complete project index

Infrastructure & Operations / Built / deployed

Caddy Gateway & Secure Ingress

Canonical L7 ingress joining Cloudflare Tunnel, Caddy, Authelia and Tailscale with per-service sessions, server-side credentials and private/public routes.

Explore architecture
STATUSBuilt / deployed
AREAInfrastructure & Operations
STACK5 documented technologies
INTEGRATIONS4 connected / bounded services
01

OVERVIEW

What I built.

Canonical L7 ingress joining Cloudflare Tunnel, Caddy, Authelia and Tailscale with per-service sessions, server-side credentials and private/public routes.

01

Consolidated HTTP/HTTPS ingress around Caddy as the canonical L7 router.

02

Integrated Cloudflare Tunnel for public transport, Tailscale for private reachability and Authelia for authentication.

03

Added per-service launch/session handling so browser users do not carry backend admin tokens.

02

SYSTEM ARCHITECTURE

How the system is divided.

01
Architecture boundary

Public: Internet -> Cloudflare Tunnel -> Caddy -> authentication/service gate -> application.

02
Architecture boundary

Private: trusted device -> Tailscale -> Caddy -> private application.

03
Architecture boundary

SIP/RTP remains outside the HTTP gateway and uses the dedicated VoIP path.

03

NETWORK / DATA FLOW

What talks to what.

04

TECHNOLOGY STACK

The technical surface.

01Caddy
02Cloudflare Tunnel
03Authelia
04Tailscale
05TLS
05

IMPLEMENTATION

How it works in practice.

  1. 01

    Public: Internet -> Cloudflare Tunnel -> Caddy -> authentication/service gate -> application.

  2. 02

    Private: trusted device -> Tailscale -> Caddy -> private application.

  3. 03

    SIP/RTP remains outside the HTTP gateway and uses the dedicated VoIP path.

06

TESTING & VALIDATION

How I know it works.

TEST 01

Public HTTPS probes

TEST 02

Private Tailscale route checks

TEST 03

Caddy config/reload validation

TEST 04

Service-session launch flow

TEST 05

Backend health checks

TEST 06

Ingress/DNS verification during migrations

07

EXTERNAL SERVICES & DEPENDENCIES

What sits outside the core.

CORECaddy Gateway & Secure Ingress
↔Cloudflare Tunnel
↔Tailscale
↔Authelia
↔Application backends
08

ENGINEERING EVIDENCE

Artifacts behind the claims.

01Caddyfile
02Tunnel desired state
03Launch broker
04Health writer
05Public/private route model
06Legacy ingress retirement
09

BOUNDARIES / CONSTRAINTS

What the project does not pretend to solve.

—SIP/RTP intentionally bypasses the HTTP gateway

—Browser users should not handle backend admin tokens

—Tunnel transport was moved to HTTP/2 after QUIC instability

10

RESULT / CURRENT STATE

What this produced.

A single understandable ingress boundary with explicit public/private paths and reduced credential exposure.