Serving this site from my basement (safely)
This site isn't on a VPS or a static-hosting platform. It's an nginx container on a Proxmox node in my house. The interesting part is what's not happening: there are no ports forwarded on my router, my home IP appears nowhere in DNS, and every request you make passes through Cloudflare's edge before it ever reaches my network.
The shape of it
A lightweight daemon called cloudflared runs next to the
web server and opens an outbound connection to Cloudflare.
Traffic to my domain rides back down that tunnel. Outbound-only means
nothing on the internet can initiate a connection to my house — the
usual attack surface of self-hosting just isn't there.
visitor ──▶ Cloudflare edge (WAF, bot checks, caching)
│
▼ (tunnel, outbound from my side)
cloudflared ──▶ nginx (LXC on Proxmox)
What Cloudflare handles for me
Origin IP hiding is the headline, but the edge also gives me TLS, caching for a fully static site, bot mitigation, and WAF rules — things I'd otherwise be building and patching myself. For a static site with no server-side logic, the remaining risk mostly lives in keeping nginx and cloudflared updated, which is a cron job, not a lifestyle.
Why bother?
Because doing it yourself is the point. I review other people's architectures for a living; running my own tiny production system — patching it, monitoring it with Uptime Kuma, thinking about its failure modes — keeps that muscle honest.