Infrastructure & Operations / Built / deployed

Caddy Gateway & Secure Ingress

Canonical L7 ingress joining Cloudflare Tunnel, Caddy, Authelia and Tailscale with per-service sessions, server-side credentials and private/public routes.

Explore architecture

STATUSBuilt / deployed

AREAInfrastructure & Operations

STACK5 documented technologies

INTEGRATIONS4 connected / bounded services

OVERVIEW

What I built.

Canonical L7 ingress joining Cloudflare Tunnel, Caddy, Authelia and Tailscale with per-service sessions, server-side credentials and private/public routes.

Consolidated HTTP/HTTPS ingress around Caddy as the canonical L7 router.

Integrated Cloudflare Tunnel for public transport, Tailscale for private reachability and Authelia for authentication.

Added per-service launch/session handling so browser users do not carry backend admin tokens.

SYSTEM ARCHITECTURE

How the system is divided.

Architecture boundary

Public: Internet -> Cloudflare Tunnel -> Caddy -> authentication/service gate -> application.

Architecture boundary

Private: trusted device -> Tailscale -> Caddy -> private application.

Architecture boundary

SIP/RTP remains outside the HTTP gateway and uses the dedicated VoIP path.

NETWORK / DATA FLOW

What talks to what.

TRACE PATHFocus or tap a stage to trace the flow from source to that point.

01Internet

→data / control

02Cloudflare Tunnel

→data / control

03Caddy

→data / control

04Authelia / service gate

→data / control

05Application

TECHNOLOGY STACK

The technical surface.

01Caddy

02Cloudflare Tunnel

03Authelia

04Tailscale

05TLS

IMPLEMENTATION

How it works in practice.

01
Public: Internet -> Cloudflare Tunnel -> Caddy -> authentication/service gate -> application.
02
Private: trusted device -> Tailscale -> Caddy -> private application.
03
SIP/RTP remains outside the HTTP gateway and uses the dedicated VoIP path.

TESTING & VALIDATION

How I know it works.

TEST 01

Public HTTPS probes

TEST 02

Private Tailscale route checks

TEST 03

Caddy config/reload validation

TEST 04

Service-session launch flow

TEST 05

Backend health checks

TEST 06

Ingress/DNS verification during migrations

EXTERNAL SERVICES & DEPENDENCIES

What sits outside the core.

CORECaddy Gateway & Secure Ingress

↔Cloudflare Tunnel

↔Tailscale

↔Authelia

↔Application backends

ENGINEERING EVIDENCE

Artifacts behind the claims.

01NOTECaddyfile

02NOTETunnel desired state

03NOTELaunch broker

04NOTEHealth writer

05NOTEPublic/private route model

06NOTELegacy ingress retirement

BOUNDARIES / CONSTRAINTS

What the project does not pretend to solve.

—SIP/RTP intentionally bypasses the HTTP gateway

—Browser users should not handle backend admin tokens

—Tunnel transport was moved to HTTP/2 after QUIC instability

RESULT / CURRENT STATE

What this produced.

A single understandable ingress boundary with explicit public/private paths and reduced credential exposure.