---
type: entity
path: Wiki/Reference
tags:
  - cloudflare
  - homelab
  - automation
created: 2026-05-08
updated: 2026-05-08
---

# Cloudflare

## What it is

Cloudflare provides DNS, CDN caching, DDoS protection, and tunnel connectivity for PBS and homelab. All PBS traffic routes through Cloudflare before reaching the Linode origin server. Cloudflare Tunnel (formerly Argo Tunnel) is used to expose internal homelab services (MCP server, select homelab tools) to the internet without opening firewall ports on origin servers.

## Current state

Active across multiple roles:
- **DNS** — authoritative DNS for PBS domain and `herbylab.dev`
- **CDN caching** — cache rules tuned for PBS WordPress; last-match-wins rule ordering; cookie-based bypass for logged-in users
- **Bot Fight Mode** — enabled (added during March 2026 server stability hardening)
- **Cloudflare Tunnel** — homelab MCP server at `mcp.herbylab.dev` exposed via tunnel (no open inbound port)
- **Cache warming** — n8n daily sitemap crawl + cache purge pipeline (cloudflare-cache-warmer project)
- **Cache bypass fix** — cookie-based bypass ensures members see fresh content; n8n triggers purge on content publish

## Where it lives

- Cloudflare managed service (cloud-hosted control plane)
- `cloudflared` tunnel daemon runs on homelab/PBS Docker host
- n8n integration via Cloudflare API (cache purge webhook)

## Related projects

- [[Sources/Dev/cloudflare-cache-rules|cloudflare-cache-rules]] — cache rule configuration session
- [[Sources/Dev/cloudflare-cache-strategy|cloudflare-cache-strategy]] — cookie bypass + n8n purge strategy
- [[Sources/Dev/cloudflare-cache-warmer|cloudflare-cache-warmer]] — daily cache warming
- [[Sources/Homelab/homelab-mcp-server|homelab-mcp-server]] — tunnel for MCP server
- [[Sources/Homelab/server-stability-and-security-hardening|server-stability-and-security-hardening]] — Bot Fight Mode
- [[Wiki/Reference/traefik|traefik]] — origin ingress
- [[Wiki/Reference/n8n|n8n]] — cache purge automation
- [[Wiki/Homelab/homelab-ingress-stack|homelab-ingress-stack]] — synthesis

## History

- Ongoing — Core DNS + CDN layer for PBS
- **2026** — Cache rule last-match-wins ordering locked; cookie bypass implemented
- **March 2026** — Bot Fight Mode enabled during server stability hardening
- **2026-05-06** — Cloudflare Tunnel deployed for MCP server at `mcp.herbylab.dev`
- **Planned** — Cache warming automation via n8n daily job