My WordPress site runs on a Intel NUC sitting on a shelf in my home office. It serves real traffic, has a proper SSL certificate, and costs exactly $0 per month to host. No VPS, no cloud hosting bill, no open firewall ports. This is how I did it using Cloudflare Tunnel — and why it is one of the most underrated tools in a homelab engineer's toolkit.
The Problem With Traditional Homelab Hosting
Hosting a website from home has always had the same friction points:
- Dynamic IP address — your ISP changes your public IP regularly, breaking DNS
- Port forwarding — opening ports 80 and 443 on your router exposes your home network
- No SSL without complexity — getting a real certificate requires Let's Encrypt automation or similar
- ISP blocking — many residential ISPs block inbound connections on port 80/443
Cloudflare Tunnel solves every single one of these problems simultaneously — and the free tier is genuinely free with no traffic limits.
How Cloudflare Tunnel Works
Instead of accepting inbound connections, your server makes an outbound connection to Cloudflare's edge network. Cloudflare holds that connection open and routes public traffic through it to your server. From the internet's perspective, your site lives on Cloudflare's infrastructure. From your server's perspective, it is just sending and receiving data over an outbound HTTPS connection it initiated.
Internet visitor
|
v
Cloudflare Edge (anycast, global CDN)
|
| encrypted tunnel (outbound from your server)
v
cloudflared daemon (running on your homelab)
|
v
Your WordPress container (port 8080, localhost only)
Your server never needs to accept a connection from the outside world. No open ports. No firewall rules. No exposed services.
The Stack
Here is the exact setup running this site:
- Server — Intel NUC, Rocky Linux 9, 32GB RAM
- Containers — Podman (rootless) running WordPress, MariaDB, Redis, and cloudflared
- Tunnel — Cloudflare Tunnel via the official
cloudflare/cloudflaredcontainer image - SSL — Cloudflare Full mode — SSL between visitor and Cloudflare edge, plain HTTP between cloudflared and WordPress internally
- DNS — Cloudflare manages the domain, tunnel endpoint is configured automatically
Setting Up Cloudflare Tunnel
The setup takes about 20 minutes if you already have a domain on Cloudflare.
Step 1 — Create the Tunnel
Log into the Cloudflare dashboard, navigate to Zero Trust → Networks → Tunnels and create a new tunnel. Give it a name and copy the tunnel token — you will need it in the next step.
Step 2 — Run cloudflared
Add the cloudflared container to your compose stack:
cloudflared:
image: cloudflare/cloudflared:latest
container_name: cn_cloudflared
restart: unless-stopped
command: tunnel --no-autoupdate run
environment:
- TUNNEL_TOKEN=your_tunnel_token_here
networks:
- wordpress_net
Step 3 — Configure the Public Hostname
In the Cloudflare dashboard under your tunnel settings, add a public hostname:
- Subdomain — leave blank for root domain or enter www
- Domain — your domain
- Service —
http://your_wordpress_container:8080
Cloudflare automatically creates the DNS record. SSL is handled at the edge. Your WordPress container never needs to know about SSL at all.
Step 4 — WordPress Configuration
Tell WordPress its public URL so links and redirects work correctly:
define('WP_HOME', 'https://yourdomain.com');
define('WP_SITEURL', 'https://yourdomain.com');
Also add the Cloudflare IP forwarding header so WordPress sees real visitor IPs instead of the tunnel IP:
// In wp-config.php
if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
www Redirect
Since Cloudflare manages DNS, you can add a redirect rule directly in the Cloudflare dashboard rather than configuring Apache or Nginx. Under Rules → Redirect Rules, create a rule to redirect www.yourdomain.com to yourdomain.com with a 301 status. No server configuration required.
Performance Considerations
Routing traffic through Cloudflare's edge adds a small amount of latency versus direct hosting — typically 10-30ms depending on visitor location. In practice this is imperceptible to users and is more than offset by Cloudflare's CDN caching static assets closer to visitors.
The more significant constraint is upload bandwidth — your home internet connection becomes the limiting factor for serving large files. For a text-heavy site like a certification guide or news blog this is rarely an issue. For sites serving large video or binary files, a CDN offload strategy would be needed.
Security Benefits
Beyond the convenience, Cloudflare Tunnel improves security in several meaningful ways:
- No open ports — your router firewall stays completely closed to inbound traffic
- DDoS protection — Cloudflare absorbs volumetric attacks at the edge before they reach your server
- WAF included — the free tier includes basic web application firewall rules
- Bot protection — Cloudflare filters malicious crawlers before they reach WordPress
- Your home IP stays hidden — visitors never see your residential IP address
Cost Breakdown
Here is the actual monthly cost of running this setup:
- Cloudflare Tunnel — $0 (free tier, no traffic limits)
- Cloudflare DNS — $0
- SSL certificate — $0 (managed by Cloudflare)
- CDN — $0
- DDoS protection — $0
- Server hardware — already owned (NUC, one-time purchase)
- Electricity — approximately $3-5/month for the NUC at idle
Compare this to a basic VPS at $5-20/month, a managed WordPress host at $15-50/month, or a cloud VM running 24/7. For a homelab engineer who already owns the hardware, the ongoing cost is essentially just electricity.
Limitations to Know
Cloudflare Tunnel is not the right solution for every use case. Be aware of these constraints:
- Cloudflare Terms of Service — the free plan prohibits serving large amounts of non-HTML content (video, large binaries) through the CDN. Text and images for a typical website are fine.
- Tunnel availability tied to your server — if your home internet goes down, so does your site. For high-availability requirements, this is not suitable without a failover.
- Cloudflare dependency — your site's availability depends on Cloudflare's infrastructure. In practice Cloudflare has excellent uptime but it is a dependency to acknowledge.
Is It Production Ready?
For content sites, blogs, certification guides, and portfolio sites — absolutely yes. This site serves real traffic daily with automated content pipelines, newsletter delivery, and API integrations all running through Cloudflare Tunnel without issues.
For applications requiring sub-100ms response times, websockets at scale, or guaranteed uptime SLAs — you would want dedicated infrastructure. But for the vast majority of homelab web projects, Cloudflare Tunnel removes every traditional barrier to self-hosting.
If you are studying for cloud certifications and want hands-on experience with networking, DNS, reverse proxies, and containerization — setting up a site with this stack is one of the most practical projects you can do. It touches concepts tested in the AWS, Azure, and Kubernetes certification tracks in a real-world context.
