Zero Trust instead of open dashboards
Problem An internal homelab dashboard was publicly reachable through a subdomain.
Reachable only with login
- Cloudflare Tunnel as the only entry point — no port forwarding on the router
- Access policy: only my email, login via one-time PIN
- Private services exclusively via Tailscale
- Lesson: regularly check what DNS and tunnels actually publish
