ceds-homelab/docs/Add_New_Service_Guide.md

Adding a New Service to Cloudflare Tunnel + NGINX Proxy Manager

Architecture Flow

Browser
  │
  ▼
Cloudflare DNS (cedshomelab.com)
  │
  ▼
Cloudflare Edge (SSL, Zero Trust)
  │
  ▼
Cloudflare Tunnel (cloudflared)
  │
  ▼
NGINX Proxy Manager (10.10.30.210)
  │
  ▼
Internal Service (10.10.30.X:PORT)

---

Step-By-Step Checklist

1. Gather Service Info

• Subdomain: service.cedshomelab.com
• Internal IP: 10.10.30.X
• Port: PORT
• Scheme: http or https

Test local access:

• LAN: http://10.10.30.X:PORT

---

2. (Optional) Create DNS Route in Tunnel

Inside NPM container:

cloudflared tunnel route dns npm-tunnel service.cedshomelab.com

---

3. Add Proxy Host in NGINX Proxy Manager

Open NPM: http://10.10.30.210:81

Go to: Hosts → Proxy Hosts → Add Proxy Host

Details tab:

• Domain Names: service.cedshomelab.com
• Scheme: http or https
• Forward Hostname/IP: 10.10.30.X
• Forward Port: PORT

Enable:

• Block Common Exploits
• Websockets Support

---

4. HTTPS Self-Signed Backends (Optional)

If backend uses self-signed HTTPS (e.g., Proxmox, TrueNAS):

In NPM Advanced tab:

proxy_ssl_verify off;
proxy_ssl_verify_depth 1;
proxy_ssl_name 10.10.30.X;

---

5. SSL Tab

Since Cloudflare provides SSL:

• SSL Certificate: None
• Force SSL: Off
• HSTS: Off
• HTTP/2: Off

Save.

---

6. Test External Access

Open: https://service.cedshomelab.com

If issues:

• 404: hostname not in ingress
• 502/504: NPM can’t reach backend
• Cloudflare 52x: tunnel or DNS issue

---

Notes

• Wildcard routing *.cedshomelab.com sends all new subdomains to NPM automatically.
• Only NPM needs to be updated for new services.
• No need to open router ports.

---

Example

For Jellyfin on http://10.10.30.143:30013:

cloudflared tunnel route dns npm-tunnel jellyfin.cedshomelab.com

In NPM:

• Domain: jellyfin.cedshomelab.com
• Scheme: http
• IP: 10.10.30.143
• Port: 30013
• Block Exploits: On
• Websockets: On

Save & test: https://jellyfin.cedshomelab.com