🕳️ HomeLab Chronicles: Episode 9 - Tunnel Vision
Hey all 👋 State of the lab: two nodes, Flux in charge, Airflow alive, backups nightly, RBAC banished to therapy. The UI works from anywhere in the house. But "in the house" is a service radius measured in Wi-Fi bars, and I wanted my Airflow at airflow.sanskararora.in , from anywhere, like a person with a real platform and not two laptops fighting a router for their lives. The classic move is…
In the ninth episode of the HomeLab Chronicles, the focus is on achieving internet-accessible Airflow from anywhere, without compromising security. The lab currently consists of two nodes, with Flux and Airflow functioning properly. However, the challenge lies in making Airflow accessible at airflow.sanskararora.in from any location, while avoiding the pitfalls of port forwarding, router unreliability, and public IP exposure.
Cloudflare Tunnel emerges as the solution, enabling secure, outbound-only access to the Airflow service. A small daemon called cloudflared runs within the Kubernetes cluster, establishing an outbound connection to Cloudflare's edge. Traffic from the domain then travels through this already-open connection, eliminating the need for inbound ports or exposing a public IP.
Two approaches to setting up Cloudflare Tunnel are presented: locally-managed and remotely-managed. The locally-managed method involves creating a tunnel on the machine using cloudflared tunnel create, with routing rules stored in a configuration file within the git repository. The remotely-managed method utilizes the Zero Trust dashboard, where a token is generated and the routing rules are live in the UI.
The remotely-managed tunnel is set up by creating a Deployment with two replicas and anti-affinity, ensuring the tunnel's resilience in the face of node failures. The tunnel's token is securely stored in a Secret, which is then referenced in the Deployment's environment variables. The Public Hostname is configured in the dashboard to map to the Airflow service, and the DNS record is automatically generated.
After implementing the tunnel, the Airflow admin login can be accessed from anywhere, protected by one password and terminated within the house. However, the security concerns remain, as the system now serves as a juicy target for potential attackers. Despite this, the lesson learned is that outbound-only connections offer superior security, eliminating inbound holes and public IP exposure.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
