Skip to content
Home

How this site is served

A Linux machine at home and an outbound-only Cloudflare tunnel.

Visitor

resolves jorgecarbajal.dev

Cloudflare edge

DNS · TLS termination · caching

kepler — my machine, at home

cloudflared.service

  • 127.0.0.1:3000 · website.service

    Next.js — this site

  • 127.0.0.1:8000 · uvicorn

    FastAPI — Job Board Finder

No inbound ports are open. Nothing else on the network can reach these.

What happens when you load this page

  1. Your browser resolves jorgecarbajal.dev and gets Cloudflare's IPs. My home IP address appears nowhere in public DNS.
  2. You connect to Cloudflare, which terminates TLS at the edge near you.
  3. A cloudflared daemon on my machine has already dialed outward to Cloudflare and is holding that connection open. Cloudflare pushes your request down it.
  4. cloudflared hands the request to the right local service based on hostname — this site on 127.0.0.1:3000, the Job Board Finder demo on 127.0.0.1:8000.

Keeping it up

Everything runs as a systemd service, so it starts at boot and restarts on failure: cloudflared.service for the tunnel, website.service for this site, and a unit for the FastAPI demo. Deploying is a build and a restart.

The stack

  • Site — Next.js 16 (App Router), React 19, TypeScript, Tailwind 4. Every page is prerendered at build time.
  • Machine — Ubuntu 26.04 LTS, Node 22 from the distribution repository, so systemd gets a stable absolute path to the binary.
  • Edge — Cloudflare Tunnel, one tunnel, ingress rules routing each hostname to its local port.