Where Tailscale Serve Fits Beside Caddy and a Public Cloudflare Tunnel
Private tailnet publishing and public internet publishing are different ingress jobs, even when they reach the same container.
Cloudflare Tunnel
Cloudflare Tunnel Disruptions Need Log-Derived Monitoring
An external endpoint can flap because the tunnel reconnects even when the local service and LAN probe remain healthy.
Cloudflare Tunnel Reaches Caddy but Still Returns 502
The failing TLS identity may be on the Cloudflare-to-origin leg rather than in Caddy's upstream proxy.