I want .info domain on Cloudflare for my Caddy docker setup

I want .info domain on Cloudflare for my Caddy docker setup - Gemini

See: Next Steps to Deploy & Docker Deployment Guide - below

You

I have Cox Cable Internet (Spectrum) in Las Vegas, NV. Do I have a web server there?

Gemini

No, you do not automatically have a web server hosted or provided by Cox or Spectrum just by subscribing to residential internet service.

Here is how hosting or running a web server works on a residential connection in Las Vegas:

1. Web Hosting Provided by ISPs

Neither Cox Communications nor Spectrum offers web hosting or personal web server hosting as a standard feature bundled with residential internet packages. If you want to host a website or application accessible to the public on the web, you need to set one up yourself or host it elsewhere.

2. Can You Run a Web Server on Your Home Connection?

If you want to run a web server (like Apache, Nginx, or Caddy) locally from home:

  • Port Restrictions: Cox explicitly blocks inbound Port 80 (HTTP) on residential connections to prevent residential users from hosting public web servers. However, Port 443 (HTTPS) is generally unblocked, as are high-numbered ports (e.g., 8080, 8443).
  • Dynamic IP Addresses: Residential accounts use dynamic IP addresses that change periodically rather than a fixed static IP address. To access a home server remotely, you would need to set up a Dynamic DNS (DDNS) provider (such as DuckDNS, Cloudflare, or No-IP) to map your domain to your changing IP.
  • Terms of Service: Residential acceptable use policies generally discourage or prohibit running commercial or high-traffic public web servers. Small-scale personal hosting, self-hosted dashboards, or remote administration interfaces for personal use are fine as long as traffic remains light.

3. Alternative Hosting Options

  • VPS / Cloud Hosting: If you need a web server with a dedicated static IP, high uptime, and open ports, a Virtual Private Server (VPS) from a cloud host is usually the standard solution.
  • Tunnels / Reverse Proxies: If you are running web services locally on your home network and want secure access without port forwarding or exposing your home IP directly, tools like Cloudflare Tunnels (cloudflared), Tailscale, or WireGuard allow secure remote access or public routing into a local machine.

You

Explain Tunnels / Reverse Proxies

Gemini

Both Reverse Proxies and Tunnels solve a fundamental networking problem: how to cleanly and safely route web traffic to a server. However, they work at different layers and address distinct access challenges.

1. Reverse Proxies

A standard proxy sits in front of clients (users) to forward their outbound requests to the internet. A reverse proxy does the opposite: it sits in front of backend servers and handles incoming requests on their behalf.

Client (Browser) ──► Internet ──► [ Reverse Proxy ] ──┬──► Web App A (Port 8080)
                                   (Port 80 / 443)    ├──► Web App B (Port 3000)
                                                      └──► Dashboard (Port 9000)

Core Responsibilities

  • Single Entry Point: Instead of remembering individual port numbers (e.g., 192.168.1.50:8080, 192.168.1.50:9000), the proxy listens on standard HTTP/HTTPS ports (80/443) and routes subdomains or paths to the correct internal service (e.g., app.domain.com vs dash.domain.com).
  • SSL/TLS Termination: The proxy handles SSL certificates (e.g., Let's Encrypt). Traffic between the client and proxy is encrypted with HTTPS, while traffic between the proxy and local containers/services can stay plain HTTP over the local network.
  • Security & Abstraction: It shields internal machine IPs and ports from public visibility. It can also handle basic authentication, rate limiting, and web application firewall (WAF) filtering before traffic ever hits your application.
  • Load Balancing: It can split incoming requests across multiple backend instances for high availability.

Common Implementation Tools

  • Nginx & HAProxy: High-performance, traditional workhorses configured via config files.
  • Caddy: Modern reverse proxy with automatic, zero-config HTTPS via Let's Encrypt.
  • Traefik: Cloud-native reverse proxy designed to automatically detect container labels in Docker networks.

2. Tunnels (Reverse Tunnels)

A tunnel solves a routing restriction—specifically when your server is behind dynamic IPs, CGNAT (Carrier-Grade NAT), or firewall rules that block inbound ports (such as ISP blocks on Port 80/443).

Instead of receiving inbound traffic directly, an agent running on your local machine establishes an outbound persistent connection to a public edge node.

[ Local Server ] ──(Outbound Tunnel Connection)──► [ Public Cloud / Edge Node ] ◄── Client Request
   (No Open Ports)                                      (Public IP / Anycast)

Key Advantages

  • No Open Ports Needed: You do not need to configure router port forwarding or open any inbound ports in your firewall.
  • Bypasses ISP Blocks & CGNAT: Because the connection is outbound from your network (typically via HTTPS or WebSockets), it passes straight through residential ISP restrictions or carrier NAT setups.
  • IP Hiding: Your residential IP address is never exposed to public DNS queries; visitors only see the public tunnel edge node.

Common Tunnel Approaches

  1. Cloudflare Tunnels (cloudflared): Runs a local daemon that establishes outbound connections to Cloudflare's nearest edge data center. Incoming public requests hit Cloudflare, pass through their security/CDN layer, and travel down the tunnel to your machine.
  2. Self-Hosted Reverse Tunnels (SSH / FRP / BoringProxy): If you rent a small Cloud VPS with a public static IP, you can run a reverse SSH tunnel or an agent like frp (Fast Reverse Proxy). The VPS receives incoming traffic and sends it down the established tunnel to your internal system.
  3. Mesh VPN Tunnels (Tailscale, WireGuard, Overlay Networks): Instead of exposing a service publicly to the internet, mesh VPNs build an encrypted, point-to-point overlay network between your specific devices. Tailscale (built on WireGuard) allows you to securely access local ports across any network without public web exposure.

Summary Comparison

Feature Reverse Proxy Cloud/Reverse Tunnel Private VPN Tunnel (Tailscale)
Primary Goal Traffic routing, SSL, and single-port management Bypassing NAT/firewalls for public access Secure private remote access
Requires Open Inbound Ports? Yes (Requires 80/443 forwarded) No (Outbound connection only) No (NAT traversal)
Exposes Public Endpoint? Yes Yes (via Tunnel provider) No (Authorized devices only)
Hides Home IP? No (resolves to home IP) Yes (resolves to tunnel edge) Yes
Best For... Self-hosting with a static IP / open ports Exposing local web apps without port forwarding Accessing home infrastructure privately from anywhere

You

Does cloudflared cost money?

Gemini

No, cloudflared (Cloudflare Tunnel) is completely free for personal and hobbyist use.

It is part of the Cloudflare Zero Trust ecosystem. Cloudflare offers a generous free tier for Zero Trust that includes:

  • Up to 50 active users on an account at no cost.
    Reddit
  • Unlimited outbound tunnels via cloudflared.
  • Unlimited bandwidth routed through the tunnel for standard web application traffic.
  • Included SSL certificates automatically issued and managed for your tunneled domains.

What Do You Need to Use It Free?

To set up a permanent Cloudflare Tunnel with cloudflared, you need:

  1. A custom domain name managed by Cloudflare's DNS (which requires buying a domain, usually ~$10/year from any registrar, or transferring DNS management of an existing domain to Cloudflare's free DNS service).
  2. A free Cloudflare account with Zero Trust enabled.
    SpendHound

(Note: If you don't own a custom domain, you can also run temporary quick tunnels via cloudflared tunnel --url http://localhost:8080, which gives you a free random trycloudflare.com URL without creating an account or registering a domain.)

Are There Any Paid Limits or Restrictions?

For a self-hoster, home lab administrator, or developer, you will likely never hit a paid barrier. However, there are a few edge cases where costs or terms apply:

  • Commercial / Enterprise Scale: The free tier covers up to 50 users/seats. If you deploy it for a business with more than 50 employees accessing internal tools, you pay per additional user per month.
    Reddit
  • Terms of Service (Section 2.8 - Large Static Files/Media Streaming): Cloudflare's free plan TOS restricts using their CDN/Tunnel network primarily for hosting massive static video streaming files or high-volume non-HTML file delivery without an Enterprise plan. Standard video stream hosting or heavy media streaming directly through free public tunnels can violate TOS, though normal personal streaming (e.g., streaming Plex/Jellyfin to just yourself via private access) is widely done using Zero Trust authentication policies.

Want me to show you how to set up a free Cloudflare Tunnel using Docker?

You

Show me how to set up a Cloudflare Tunnel using Docker to route a custom domain to a local web app without port forwarding.

Gemini

To route traffic from a custom domain to a local web application without opening router ports, the recommended approach is using a Cloudflare Remotely-Managed Tunnel running via Docker Compose.

Prerequisites

  1. A domain added to Cloudflare with its DNS active.
  2. Docker and Docker Compose installed on your local host system.

1

Create the Tunnel in Cloudflare Zero Trust

Obtain your TUNNEL_TOKEN string from the dashboard

  1. Log in to the Cloudflare Dashboard.
  2. Navigate to Zero Trust in the left sidebar.
  3. Go to Networks Tunnels and click Add a tunnel.
  4. Select Cloudflared as the connector type and click Next.
  5. Give your tunnel a descriptive name (e.g., homelab-tunnel) and click Save tunnel.
  6. On the Install connector screen, choose Docker.
  7. Copy the command provided by Cloudflare. Locate the long alphanumeric string following --token —this is your TUNNEL_TOKEN.

2

Set Up Your Docker Compose Environment

Run both the app and cloudflared on an internal bridge network

Create a project directory on your server and add a docker-compose.yml file. Connecting cloudflared directly to your app's internal Docker network allows cloudflared to reach your app using its container service name.

Create docker-compose.yml:

version: "3.8"

networks:
  tunnel_net:
    driver: bridge

services:
  # Example Web Application
  web-app:
    image: nginx:alpine
    container_name: web-app
    restart: unless-stopped
    networks:
      - tunnel_net
    # Note: No "ports:" block is needed here; access goes purely through the bridge network.

  # Cloudflare Tunnel Agent
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    networks:
      - tunnel_net
    environment:
      - TUNNEL_TOKEN=YOUR_CLOUDFLARE_TUNNEL_TOKEN_HERE
    command: tunnel --no-autoupdate run

Replace YOUR_CLOUDFLARE_TUNNEL_TOKEN_HERE with the token copied in Step 1.

3

Launch the Stack

Bring up the containers

In your project directory, execute:

docker compose up -d

Verify the tunnel connected successfully by checking the logs:

docker logs cloudflared

Look for messages indicating successful connections to Cloudflare edge locations.

4

Configure Public Hostname Routing

Map domain queries to your Docker container in Cloudflare

  1. Return to the Cloudflare Zero Trust Tunnel setup page.
  2. Under Public Hostname Page, click Add a public hostname.
  3. Configure the fields as follows:
    • Subdomain: app (or leave blank for root domain)
    • Domain: Choose your domain from the dropdown list.
    • Type: HTTP
    • URL: web-app:80 (uses the Docker container name and its internal port)
  4. Click Save hostname.

Cloudflare will automatically manage the required CNAME records in your DNS dashboard.

Verification

Navigate to [https://app.yourdomain.com](https://app.yourdomain.com) in a browser. Traffic will flow securely:

No inbound ports (80/443) are required to be open on your home router/firewall.

You

Can I use DuckDNS.org for my domain?

Gemini

Yes, you can use DuckDNS.org, but how you use it depends on whether you are using traditional Port Forwarding or a Cloudflare Tunnel:

Scenario A: Traditional Port Forwarding or Reverse Proxies (Nginx, Caddy)

Yes, DuckDNS is built specifically for this.

If you are opening ports on your router or using a local reverse proxy (like Nginx, Caddy, or Traefik), DuckDNS works out of the box:

  • DuckDNS gives you a free subdomain (e.g., yourname.duckdns.org).
  • You run a small script or Docker container that periodically updates DuckDNS with your current home IP address.
  • You point traffic directly to yourname.duckdns.org, and it routes to your home router.

Scenario B: Cloudflare Tunnels (cloudflared)

No, you cannot use a duckdns.org subdomain directly as the primary domain for a Cloudflare Tunnel.

Cloudflare Tunnels require you to add the domain into your Cloudflare account control panel so Cloudflare can manage the zone's DNS records. Because duckdns.org is owned by DuckDNS (not you), Cloudflare will not allow you to add *.duckdns.org as an apex zone in your account.

The Workarounds if using Cloudflare Tunnels:

  1. Get a Cheap Custom Domain (~$2 - $10/yr): Buy a cheap domain (like .com, .org, or .xyz from Namecheap, Porkbun, or Cloudflare Registrar). Add it to your free Cloudflare account, and you get full, native support for Cloudflare Tunnels with unlimited subdomains.
    Reddit
  2. CNAME Mapping (If you own a custom domain AND want DuckDNS): If you own yourdomain.com managed on Cloudflare DNS, you can create a CNAME record inside Cloudflare that points subdomain.yourdomain.com to yourname.duckdns.org. However, if you are already using cloudflared, you don't actually need DuckDNS at all because the tunnel handles dynamic IP changes automatically.

Summary Recommendation

Setup Method Can use DuckDNS? Needs Dynamic IP Script? Requires Open Ports?
Direct Port Forwarding Yes (*.duckdns.org) Yes Yes (Port 80/443)
Local Reverse Proxy (Caddy/Nginx) Yes (*.duckdns.org) Yes Yes (Port 80/443)
Cloudflare Tunnel (cloudflared) No (Requires owned zone) No (Handled automatically) No (100% outbound)

If your goal is to stay 100% free with no router port forwarding, you can use Tailscale with DuckDNS or use a quick Cloudflare try-tunnel. If you want a clean public HTTPS URL without open ports via Cloudflare Tunnels, picking up an inexpensive custom domain is the standard path.

You

Explain Cloudflare try-tunnel

Gemini

A Cloudflare Try-Tunnel (officially called a Quick Tunnel or TryCloudflare) is a zero-configuration tool designed for temporary testing and sharing local web applications.

It operates like a free, native alternative to tools like ngrok or LocalTunnel, allowing you to expose a local web service to the internet without creating a Cloudflare account, buying a domain, or opening router ports.

Key Features

  • No Credentials Needed: You do not need to log in, provide an API key, or register a custom domain.
    jonasclaes.be
  • Automatic HTTPS: Cloudflare provisions an ephemeral *.trycloudflare.com subdomain complete with an SSL certificate automatically.
  • No Open Ports: Traffic routes through an outbound connection created by cloudflared to Cloudflare's edge network.

How to Use It

Running a Quick Tunnel requires a single CLI command or a simple Docker container run.

Option 1: Via Binary

If you have cloudflared installed locally, point it to the port where your local service is running:

cloudflared tunnel --url http://localhost:8080

Option 2: Via Docker

If you prefer running ephemeral tools in Docker, pass the host network or container IP:

docker run --rm -it --network host cloudflare/cloudflared:latest tunnel --url http://localhost:8080

Once executed, cloudflared outputs a temporary URL in the terminal:

2026-08-31T18:18:02Z INF Thank you for trying Cloudflare Tunnel. Doing quick setup...
2026-08-31T18:18:03Z INF Your quick Tunnel has been created!
2026-08-31T18:18:03Z INF +-----------------------------------------------------------------------+
2026-08-31T18:18:03Z INF |  Your free tunnel is live! Visit it at:                               |
2026-08-31T18:18:03Z INF |  https://random-words-1234.trycloudflare.com                          |
2026-08-31T18:18:03Z INF +-----------------------------------------------------------------------+

Anyone with that link can immediately access your local web application via HTTPS.

Quick Tunnels vs. Standard Tunnels

Feature Quick Tunnel (trycloudflare.com) Standard Named Tunnel (cloudflared)
Primary Use Case Testing, demoing APIs, temporary previews Permanent self-hosting, personal apps
Domain Random *.trycloudflare.com URL Your own custom domain (app.yourdomain.com)
URL Stability Ephemeral: Changes every time the process stops Permanent: Stays the same permanently
Cloudflare Account Not Required Required (Free tier available)
Zero Trust Policies No Access policies (SSO/PIN protection) Fully supports Cloudflare Access policies

Important Limitations

  1. URL Changes on Restart: Whenever the terminal session ends, the container stops, or the network drops, the URL is destroyed. Restarting generates a new, random subdomain name.
  2. No Access Control: Anyone who gets the URL can access the app. Do not expose sensitive administrative tools or databases using quick tunnels.
  3. No Custom Subdomains: You cannot request a static or customized trycloudflare.com sub-name.

You

I have Caddy on Docker on http://0.0.0.0:32768. Can I use it with trycloudflare.com

Gemini

Yes, absolutely. You can point trycloudflare.com directly at Caddy running on port 32768.

When you run cloudflared, it acts as a client that fetches content from your local host port (where Caddy is exposed) and streams it out to the random trycloudflare.com URL.

How to Connect Them

Depending on how you run cloudflared, choose one of the options below:

Option 1: Running cloudflared directly on your host machine (CLI)

If you installed the cloudflared binary directly on your system OS:

cloudflared tunnel --url http://127.0.0.1:32768

Option 2: Running cloudflared via Docker

If you want to run the Quick Tunnel inside a standalone Docker container, tell it to talk to your host system's IP address or use host networking:

  • Linux (Docker Host): 
    docker run --rm -it --network host cloudflare/cloudflared:latest tunnel --url http://127.0.0.1:32768
  • Docker Desktop (Mac / Windows): 
    docker run --rm -it cloudflare/cloudflared:latest tunnel --url http://host.docker.internal:32768
  • Same Docker Network: If Caddy and cloudflared share a custom Docker bridge network, you don't even need port 32768. Point cloudflared directly to Caddy's container name and internal port: 
    docker run --rm -it --network my_app_network cloudflare/cloudflared:latest tunnel --url http://caddy_container_name:80

Important Caddy Configuration Tip

When traffic hits your trycloudflare.com URL, Cloudflare forwards the HTTP Host header (e.g., Host: random-words-1234.trycloudflare.com) to Caddy.

To ensure Caddy routes the incoming request properly, make sure your Caddyfile handles arbitrary hostnames or uses a wildcard catch-all:

# Catch-all block to accept incoming requests regardless of the hostname header
:80 {
    respond "Hello from Caddy via TryCloudflare!"
    
    # Or proxy to an internal app:
    # reverse_proxy local-app:8080
}

If your Caddyfile is locked to a specific domain (e.g., example.com { ... }), Caddy will reject incoming trycloudflare.com requests with a 404 or error because the domain header won't match. A catch-all :80 or :32768 block ensures it responds smoothly.

You

Will I be able to get a url to put in DuckDNS.org when using trycloudflare.com

Gemini

No, not in the way you are hoping.

You cannot link your DuckDNS domain (yourname.duckdns.org) to a trycloudflare.com URL so that people can visit your persistent DuckDNS address.

Why This Doesn't Work

  1. DuckDNS only tracks IP addresses: DuckDNS is purely a Dynamic DNS (DDNS) provider. Its control panel only accepts IPv4 or IPv6 numerical addresses (e.g., 123.45.67.89). It does not support CNAME records or domain redirection inside the DuckDNS dashboard. Because trycloudflare.com provides a URL (not a static IP), DuckDNS has nowhere to map it.
  2. Quick Tunnels expire & change: Every time you start or restart trycloudflare.com, Cloudflare generates a brand-new random URL (e.g., happy-cats-1234.trycloudflare.com). Even if you redirected traffic, the underlying URL would break the moment your tunnel reconnected.
  3. Cloudflare blocks unmanaged CNAME aliases: Even if you tried setting up an HTTP redirect elsewhere, Cloudflare's edge security will drop requests sent to random-words.trycloudflare.com if the browser's Host header doesn't match the exact temporary tunnel URL Cloudflare generated for that session.

What You Can Do Instead

If you want a fixed URL (whether that's a DuckDNS address or a custom domain) without opening router ports, pick one of these two options:

Option A: Free & Private (Use DuckDNS + Tailscale)

If the service is only for you or a few personal devices:

  • Keep your DuckDNS name or use Tailscale's free MagicDNS.
  • Install Tailscale on your server and client devices (phone, laptop).
  • Tailscale creates a secure private mesh tunnel directly to your Caddy container on port 32768. You get full remote access without exposing anything publicly or messing with Cloudflare.

Option B: Free & Public (Cloudflare Permanent Tunnel)

If you want the service publicly accessible to anyone on a fixed URL:

  • Register a cheap domain name (around $2 to $10/year on Porkbun, Namecheap, or Cloudflare Registrar).
  • Set up a Named Cloudflare Tunnel instead of a Quick Tunnel.
  • This gives you a permanent, unchanging address (like caddy.yourdomain.com) that routes through Docker with zero open ports and full HTTPS.

You

What is the cost of a domain on Cloudflare Registrar

Gemini

Cloudflare Registrar sells domains at-cost (wholesale pricing with zero markups, fees, or hidden renewal price hikes). You pay only the baseline ICANN fee plus the exact price charged by the registry.

Because they pass through wholesale costs, the registration price and the renewal price are identical every year.

Here is what common top-level domain (TLD) extensions cost on Cloudflare:

Extension Registration & Renewal / Year Notes
.xyz ~$10.00 – $11.00 Great for home labs, tunnels, and test sites
.com ~$10.44 (includes ICANN fee) Standard worldwide web extension
.org ~$10.00 – $11.00 Non-profit / standard TLD
.net ~$11.00 – $12.00 Standard infrastructure TLD
.info ~$4.00 – $5.00 Very inexpensive general option
.dev / .app ~$12.00 – $14.00 Enforces HTTPS-only at the browser level
.io ~$35.00 – $40.00 Popular tech/developer TLD

Key Advantages of Cloudflare Registrar

  1. No Renewal Price Surprises: Many mainstream registrars sell .com domains for $2 for the first year, but silently renew them at $20–$25/year later. Cloudflare keeps the renewal price locked to wholesale every year.
  2. Free WHOIS Privacy Protection: Included automatically to shield your home address, email, and phone number from public registries.
  3. Instant Integration: Domains purchased on Cloudflare Registrar automatically integrate into Cloudflare DNS and Cloudflare Tunnels (cloudflared) with zero DNS nameserver setup required.

You

OK. I want.info for my Caddy docker setup on port 32768. Can I do that with a virtual machine using VirtManager on MX25 Linux or Garuda Linux?

Gemini

Yes, absolutely. You can run Caddy on port 32768 inside a Virtual Machine (using VirtManager / KVM) on either Linux host, link your .info domain to a Cloudflare Tunnel, and serve traffic seamlessly.

Because the Cloudflare Tunnel agent handles the outbound connection, it doesn't care whether Docker is running on bare metal, inside a container, or inside a KVM virtual machine.

How the Networking Fits Together

There are two primary ways to route traffic from your .info domain through Cloudflare down to your VM:

Approach A: Run cloudflared directly inside the VM (Recommended)

This is the cleanest and most isolated setup. Both Caddy and cloudflared live together inside the VM guest OS.

Public (.info) ──► Cloudflare Edge ──► [ KVM VM (MX / Garuda) ]
                                            └──> cloudflared container
                                                      └──> Caddy (0.0.0.0:32768)
  • Setup: You run both Caddy and cloudflared containers inside the VM's Docker engine.
  • Why it's best: The VM requires no special port forwarding or host bridge configurations. As long as the VM has outbound internet access (standard NAT networking in VirtManager works fine), cloudflared inside the VM will dial out to Cloudflare and route requests directly to http://localhost:32768 or http://caddy_container_name:32768.

Approach B: Run cloudflared on the Host Linux OS

If you prefer keeping cloudflared on your main host machine while Caddy runs inside the VM:

Public (.info) ──► Cloudflare Edge ──► [ Host OS ] (cloudflared)
                                           │
                                     (Virtual Bridge)
                                           ▼
                                     [ KVM VM Guest ] (Caddy 0.0.0.0:32768)
  • Setup: You configure VirtManager's default network (or a bridge) so the VM gets a local IP address on your network (e.g., 192.168.122.50).
  • Tunnel Target: In the Cloudflare Zero Trust dashboard, you point the public hostname to [http://192.168.122.50:32768](http://192.168.122.50:32768).

VirtManager Network Considerations

Whether you choose MX Linux or Garuda Linux as your host:

  1. Standard NAT (default network in VirtManager):
    • Works out of the box for Approach A. The VM can initiate outbound connections to Cloudflare without any host-level firewall adjustments.
  2. Bridged Networking (macvtap or br0):
    • If you want your VM to appear as an independent device on your local LAN (e.g., getting a 192.168.1.x address alongside physical PCs), set up a Bridge interface in VirtManager. This makes accessing the Caddy interface on port 32768 from other home devices trivial while still routing public .info traffic through the tunnel.

Host OS Choice: MX Linux vs. Garuda Linux

  • MX Linux: Uses ext4 by default and Debian stability. Extremely lightweight overhead for running KVM guests.
  • Garuda Linux: Arch-based with direct access to AUR packages (virt-manager, qemu-desktop, dnsmasq, ebtables install out of the box). Very efficient for KVM hypervisors.

Both distributions fully support qemu-kvm, virt-manager, and Docker with equal performance.

Next Steps to Deploy

  1. Register your .info domain on Cloudflare Registrar (~$4.00 – $5.00/year).
  2. Create a Named Tunnel in Cloudflare Zero Trust and grab the TUNNEL_TOKEN.
  3. Inside your VM, run your Docker Compose stack containing caddy and cloudflared.
  4. Point your Cloudflare public hostname to http://localhost:32768 (or the container service name), and your .info domain will immediately resolve to your Caddy setup.

You

Write a docker-compose.yml file that runs Caddy on port 32768 alongside a cloudflared container inside a Linux VM.

Gemini

Your PDF setup guide and Docker configuration document is ready:

PDF icon Docker Deployment Guide

caddy_cloudflared_docker_setup

PDF

Docker Compose Architecture Overview

Here is the exact setup to run inside your VirtManager Linux VM (MX Linux, Garuda Linux, Debian, or Arch).

Because both containers sit on a shared Docker bridge network (caddy_net), cloudflared talks directly to caddy_server:32768 by container name over the internal network, while Caddy also binds to port 32768 on the VM host for local LAN testing.

File 1: docker-compose.yml

version: "3.8"

networks:
  caddy_net:
    driver: bridge

services:
  # --- CADDY WEB SERVER ---
  caddy:
    image: caddy:2-alpine
    container_name: caddy_server
    restart: unless-stopped
    networks:
      - caddy_net
    ports:
      - "32768:32768"  # Exposes Caddy on host port 32768 (VM local access)
      - "80:80"        # Standard HTTP internal port
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy_data:/data
      - ./caddy_config:/config
      - ./html:/usr/share/caddy  # Site files directory

  # --- CLOUDFLARE TUNNEL AGENT ---
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared_agent
    restart: unless-stopped
    networks:
      - caddy_net
    environment:
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}  # Loaded automatically from .env file
    command: tunnel --no-autoupdate run

File 2:.env

Create a .env file in the same directory as your docker-compose.yml file:

# Paste your token string from Cloudflare Zero Trust Dashboard
TUNNEL_TOKEN=eyJhIjoiZXhhbXBsZXRva2VuMTIzNDU2Nzg5MCIsImQiOiJ4eH...

File 3: Caddyfile

Create a Caddyfile in the same directory:

# Bind block for port 32768
:32768 {
    root * /usr/share/caddy
    file_server

    # If proxying to another container or local app, use:
    # reverse_proxy 127.0.0.1:8080
}

# Fallback block for default HTTP queries
:80 {
    respond "Caddy operational inside VM!" 200
}

File 4: Initial Index File (html/index.html)

Create a subfolder named html and place an index.html file inside:

<!DOCTYPE html>
<html>
<head>
    <title>My Cloudflare Tunnel Site</title>
</head>
<body style="font-family: sans-serif; background: #0f172a; color: #38bdf8; padding: 40px;">
    <h1>Hello from Caddy via Cloudflare Tunnel!</h1>
    <p>Running on port 32768 inside KVM VirtManager.</p>
</body>
</html>

Cloudflare Zero Trust Routing Settings

In the Cloudflare Zero Trust Dashboard ( Networks Tunnels Public Hostnames):

  • Public Hostname: yourdomain.info (or app.yourdomain.info)
  • Type: HTTP
  • URL: caddy_server:32768

Commands to Launch

# 1. Create directory and enter it
mkdir -p ~/caddy-tunnel/html && cd ~/caddy-tunnel

# 2. Add docker-compose.yml, .env, and Caddyfile into this folder

# 3. Start the stack
docker compose up -d

# 4. Check tunnel connectivity
docker logs -f cloudflared_agent

You

Will I be able to use DuckDNS.org if I get a.info domain from Cloudflare Registrar?

Gemini

Yes, but you will no longer need DuckDNS.org, and continuing to use it actually adds unnecessary complexity.

1. Why You Don't Need DuckDNS with a Cloudflare.info Domain

DuckDNS exists to do Dynamic DNS (DDNS) —it constantly updates a domain name with your home router's changing IP address so you can open inbound ports.

When you buy a .info domain through Cloudflare Registrar and connect it to a Cloudflare Tunnel (cloudflared):

  1. The Tunnel handles dynamic IPs automatically: The cloudflared daemon creates an outbound connection from your VM to Cloudflare's edge. Even if your ISP changes your IP address every hour, the tunnel automatically stays connected without dropping.
  2. Cloudflare manages your DNS directly: When you buy a domain on Cloudflare Registrar, Cloudflare automatically becomes your DNS host. You map subdomains (like app.yourdomain.info) straight to your Caddy container directly in the Cloudflare dashboard.

2. Can You Still Bridge DuckDNS and Cloudflare?

Technically, yes. If you wanted to route your .info domain through DuckDNS (for instance, if you were doing traditional port forwarding instead of using Cloudflare Tunnels), you would do it via a CNAME record:

  1. Point DuckDNS to your home IP address using a DDNS update script.
  2. In your Cloudflare DNS dashboard for yourdomain.info, create a CNAME record:
    • Name: subdomain (or @ for the root)
      • Target: yourname.duckdns.org

However, if you are using the Cloudflare Tunnel (cloudflared) setup in your Docker Compose stack, pointing your DNS to DuckDNS will actually break the tunnel, because Cloudflare Tunnels route through Cloudflare's internal proxy nodes rather than resolving to your residential IP.

Summary Recommendation

Once you buy your .info domain on Cloudflare and deploy your docker-compose.yml file with cloudflared:

  • Decommission DuckDNS: You can stop running DuckDNS update scripts entirely.
  • Pure Cloudflare Routing: Manage all hostnames directly on Cloudflare. Your .info domain will connect directly through the outbound cloudflared tunnel straight into Caddy on port 32768.