Introduction # It’s been a quiet few months on this blog — a summer break turned into more of a summer disappearance. But the questions didn’t stop: the one I’ve gotten most often, by far, is some version of “how do you actually get into your homelab when you’re not home?” Fair question. I’ve built a segmented home network precisely so nothing talks to anything it shouldn’t — the last thing I want to do is undo that by punching holes in the firewall for remote access.
Introduction # Following on from my posts on establishing a four-repo GitOps structure and deploying the blog itself, the next logical step is to securely expose services to the internet. This post details my approach to using Cloudflare Tunnel and Traefik for a secure, reliable, and fully automated ingress layer, managed declaratively through Argo CD.
The image is built, scanned, and pushed. The version tag is v0.1.0-alpha.7.
The artifact is already hardened. From FinTech to Homelab: Writing an Enterprise-Ready Dockerfile for Hugo was about building the container correctly. This post is about everything that has to happen after that.
In the previous post, I laid out my plan: treat this blog as a production application and host it using the same standards I apply when architecting platforms for private banking and fintech.
The Enterprise Traceability Problem # Guessing whether v1.3.0 in production actually includes yesterday’s critical security patch is a dangerous game. Knowing exactly which version of an artifact is running in any given environment isn’t just a nice-to-have dashboard feature… it’s the foundation of a reliable release process. You can never afford to wonder if the build candidate QA just signed off on is truly the exact same binary you are deploying to users.
The Question That Changed Everything # Over the past months, I’ve received a variation of the same question more than any other:
