Skip to content

ADR-0003 — Direct public exposure on a Hetzner VPS over Cloudflare Tunnel

  • Status: accepted
  • Date: 2026-06-30
  • Domain: network exposure · portfolio positioning

Context

The lab must be reachable on the public internet. There are two broad models for getting traffic to it: expose the origin directly via a public IP and DNS with the lab's own edge terminating TLS, or keep the origin hidden and pull traffic through a managed tunnel (e.g. Cloudflare Tunnel), where the provider's edge handles TLS and the origin holds only an outbound connection. A stated purpose of the lab is to demonstrate infrastructure skill — edge routing, TLS, and host hardening are part of the portfolio, not just plumbing to hide.

Decision

Direct public exposure on the Hetzner VPS with a self-managed edge. The whole point of the lab is to show that the infrastructure was actually built and operated; routing TLS through a managed tunnel would hide exactly the layer that demonstrates the skill. Owning the edge also keeps the mental model simple — a request hits the public IP, Traefik routes it, a container answers — with no external control plane in the path. It also satisfies HTTP-01's requirement for an inbound port 80 (ADR-0004). The cost is a larger attack surface and responsibility for the lab's own hardening, which is accepted and addressed by a dedicated security pass (CP3.8, CP8).

Consequences

  • Full control over and visibility into the edge — the part of the stack most worth showing — with no dependency on a third party to serve traffic; the lab works as long as the VPS does. HTTP-01 certificate issuance works without DNS-API credentials.
  • The origin IP is public, so the host carries the full internet-facing attack surface and must be hardened (firewall, minimal exposed ports, gated admin UIs — tracked as security work). No free managed DDoS protection or edge caching sits in front of the origin. All exposure discipline is the lab's own responsibility.
  • A Cloudflare proxy could be placed in front of the origin later for caching and DDoS shielding without changing the origin design, so this decision does not foreclose that path. Revisit if the host comes under abuse that managed edge protection would mitigate, or a requirement appears to keep the origin IP private.

Alternatives considered

  • Cloudflare Tunnel — rejected: hides the edge-routing/TLS/hardening layer that is itself part of what the portfolio is meant to demonstrate, and adds a third-party control plane to the request path.
  • Tailscale Funnel — rejected: convenient but tied to Tailscale's funnel limits, and niche relative to a standard public-VPS setup a reviewer would recognize.