Remote access — Tailscale and Cloudflare Tunnel

Extracted from the master document on 2026-09-04. §N numbering kept so cross-references are not broken.

32. Tailscale

docker-host:     100.95.193.112     advertises subnet 192.168.2.0/24 (approved)
backup-manager:  100.79.63.6
Windows:         100.90.123.48
Android S23:     100.89.101.62

No exit node is needed to administer the homelab; the exit node would be for routing general Internet traffic.

The warning Some peers are advertising routes but --accept-routes is false does not prevent direct access to the Tailscale IPs.

33. Cloudflare Tunnel

Name:   balserosworld-homelab
ID:     289283d9-9580-4843-a0c4-e63ef76e19f9
Stack:  /opt/stacks/cloudflared      (token in .env, not documented)

cloudflared establishes an outbound connection to Cloudflare, which allows publishing a service without port-forwarding. It is kept shut down except for one-off publishing: Proxmox and the sensitive panels are not published just because it is technically possible.

---