Turkey (Turkish)
Germany (German)
Worldwide (English)
Outbound connectivity model for public web traffic.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
Cloudflare Tunnel and Tailscale are not substitutes. One can carry public application traffic to the origin over an outbound tunnel while the other provides private overlay access for operators and nodes.
Installing Tailscale does not automatically close public SSH; Cloudflare Tunnel does not automatically secure the origin firewall. Remove obsolete inbound paths explicitly.
On the same Dokploy host, give each network one purpose: Cloudflare Tunnel for public application ingress, Tailscale for admin/SSH/internal access. Avoid overlapping route and DNS scope.
On the same Dokploy host, give each network one purpose: Cloudflare Tunnel for public application ingress, Tailscale for admin/SSH/internal access. Avoid overlapping route and DNS scope.
Use Cloudflare Tunnel for application edge and Tailscale for a private management network around Dokploy, with routes, DNS, ACLs, origin access and failure-mode design.
Outbound connectivity model for public web traffic.
WireGuard-based overlay for admins and private services.
Moving SSH/panel access to a private overlay can reduce public admin exposure.
Private-network security depends on identity and policy as much as routes.
Even with one NIC, access paths can have separate policy. Public app domains and administrator SSH do not need the same ingress mechanism.
| Flow | Transport | Identity |
|---|---|---|
| User → app | Cloudflare Tunnel | App auth / edge policy |
| Admin → SSH | Tailscale | Tailnet identity + ACL |
| Node → node | Tailscale/private route | Machine identity |
Keep catch-all rules last and do not forward unknown hostnames into origin services.
If the host is reachable by its own Tailscale IP, advertising entire Docker/VLAN subnets may create unnecessary access scope.
tailscale statustailscale ip -4ip routess -lntpAdmin laptops, CI runners, monitoring nodes and production servers should not share identical privileges. Use role/tag-based policy.
| Identity | Permission |
|---|---|
| Admin | SSH + panel |
| CI | Deploy endpoint only |
| Monitoring | Metrics only |
| App node | Required internal ports |
The same short hostname resolving differently in public and private DNS complicates troubleshooting. Use a distinct management namespace.
Verify private SSH/panel access from a second admin session before tightening public access. Keep console/BMC recovery for lockout scenarios.
tailscale ping ADMIN_DEVICEufw status numberedss -lntp | grep -E ":22|:80|:443"A Cloudflare Tunnel agent failure can affect public applications; Tailscale issues can affect administration. Define separate fallback paths.
| Failure | Impact | Fallback |
|---|---|---|
| cloudflared down | Public app ingress | Agent restart / secondary connector |
| Tailscale unavailable | Admin/private access | Console/BMC/break-glass IP |
Plan Dokploy origin, Cloudflare Tunnel and a Tailscale management network on Eka Sunucu VPS with minimal public port exposure.
Primary documentation and technical references used by this guide.
Continue with related infrastructure and implementation guides.
Dokploy Private Edge
No. Cloudflare Tunnel can serve public edge/origin connectivity while Tailscale provides private overlay and identity-based access.
After private access and break-glass recovery are validated, public SSH exposure can be reduced according to your topology.
No. Tunnel is outbound; existing inbound firewall rules remain until you change them.
There are workable designs, but administrator access still needs an identity layer such as Cloudflare Access/Tailscale/VPN plus a recovery path.