I wanted a place to document my homelab projects without paying for hosting and without handing my data to another cloud provider.
Simple goal, right?
It’s been a while since I dabbled in this stuff, and the old-school way of opening ports on your home router and hoping for the best was not going to fly.
After a lot of trial, error, and yelling at dashboards past midnight, I landed on a setup that is:
• Self-hosted
• Secure
• Free (minus the domain)
• No open ports on my router
• Protected by Cloudflare
This is the actual process that worked.
Understanding UmbrelOS
There’s plenty of options for running a homelab server, but I’m focusing on using UmbrelOS – an elegant, easy to use Debian Linux system for lightweight homelab. I’m running it on an Intel NUC with a 12th-gen i7, 64GB RAM and a 2TB NVME, so there’s plenty of CPU power and RAM headroom for running multiple lightweight servers.
I have a couple of dedicated game servers already running in Docker containers that I’ll post guides for in the future.
One of the easiest things to understand about Umbrel from the jump – Umbrel runs its applications in obfuscated Docker containers. Before I started working with Umbrel, I didn’t have much experience with Docker other than clumsily messing around with it on my NAS. The struggles I’ve had working with Portainer on my Umbrel device have taught me invaluable lessons on how this stuff works, and how files are stored.
If you’re already running UmbrelOS or are considering it for your home server, this blog is for you. For the record, I will use “Umbrel” and “UmbrelOS” interchangeably here.
The networking flow (so you know where we’re going)
Visitors → Cloudflare → Secure Cloudflare tunnel → Umbrel → WordPress Service
Cloudflare sits in front of everything and my home network never gets exposed to the internet directly.
That was the entire goal.
Step 1 — Install WordPress on Umbrel
On the Umbrel dashboard:
- Open the App Store
- Install WordPress
- Click Open and run the setup wizard
- Create your admin account
Important:
Don’t change a damn thing yet. Just make sure WordPress loads the admin console and your site locally and stop there.
Step 2 — Buy a domain via Cloudflare
I bought my domain directly through Cloudflare Registrar because:
• It’s cheap
• DNS is already where we need it
• We’ll use Cloudflare for security anyway
The domain “screamingintotheterminal.com” cost me a whopping $10.50 and refreshes every year, you can’t even get lunch for that cheap.
Once your domain shows up in Cloudflare, you’re ready for the tunnel. No need to start screwing around with DNS just yet.
Step 3 — Install the Cloudflare Tunnel app on Umbrel
This is the step that replaces all router port-forwarding.
Instead of opening your home network to the internet, your server creates a permanent outbound encrypted tunnel to Cloudflare.
Think of it as your server dialing out to Cloudflare and saying:
“If anyone asks for my website, send them through this tunnel.”
No open ports. No public IP exposure. This is the whole reason the setup is secure.
3.1 Install the Cloudflare Tunnel app on Umbrel
On your Umbrel dashboard:
- Open App Store
- Search for Cloudflare Tunnel
- Install the app
- Open it
The UI is super barebones. Click “Settings” and you’ll see a single field asking for a connector token.
We don’t have that yet — we create it in Cloudflare Zero Trust next.
Leave this page open.
3.2 Open Cloudflare Zero Trust (Cloudflare One)
Go to:
https://one.dash.cloudflare.com
This is Cloudflare’s Zero Trust dashboard, which is separate from the normal domain dashboard.
This is where tunnels live.
3.3 Create the tunnel in Cloudflare
In the left sidebar go to:
Networks → Connectors
Click:
Create a tunnel
Choose:
Cloudflared
Give the tunnel a name. Example:
Umbrel Tunnel
Click Save.
Cloudflare will now show installation options for different operating systems. It doesn’t matter what you choose.
We don’t actually install anything here because Umbrel already runs the tunnel client for us.
Scroll until you see the token.
It looks like a very long string of random characters.
Copy the entire token.
3.4 Connect Umbrel to the tunnel
Go back to the Cloudflare Tunnel app on Umbrel.
Paste the token into the connector field and save. It’ll pull out any CLI installation jargon and only the token will remain.
After a few seconds the app should show the tunnel as Running.
Back in Cloudflare Zero Trust, your tunnel should now appear as:
Status: Healthy / Connected
This confirms your Umbrel server has established a permanent encrypted tunnel to Cloudflare.
At this point your server can securely communicate with Cloudflare, but your domain still isn’t attached yet. That happens in the next step.
Step 4 — Publish WordPress through the tunnel
This is the step Cloudflare has seemingly renamed roughly twelve times. There’s other guides out there on how to set this up, and everything I’ve seen has had outdated menus and naming conventions.
In the current UI it’s called Published Application Routes.
In Cloudflare Zero Trust go to:
Networks → Overview → Route to published application
Create a route for your domain.
Route 1 (root domain)
Subdomain: leave blank
Domain: yourdomain.com
Type: HTTP
URL:
wordpress_app_1
Save.
Route 2 (www version)
Subdomain: www
Domain: yourdomain.com
Type: HTTP
URL:
wordpress_app_1
Save again.
Cloudflare automatically creates the DNS records pointing your domain to the tunnel. No router changes needed.
At this point, your site is technically reachable from the internet.
Sidebar – why HTTP and not HTTPS?
Cloudflare handles HTTPS at the edge, meaning visitors connect securely to Cloudflare while your home server receives traffic through an already encrypted tunnel. Because the traffic never travels over the public internet after that point, the connection between the tunnel and WordPress correctly uses plain HTTP.
Step 5 — Tell WordPress its real domain
Now log into WordPress using:
yourdomain.com/wp-admin or umbrel.local:8567
Go to:
Settings → General
Change BOTH of these to your domain:
WordPress Address
Site Address
Use https.
Save changes.
You’ll get logged out — that’s normal.
Step 6 — Fix WordPress behind Cloudflare
Install the plugin Really Simple SSL.
Activate it and click the button to enable SSL. It should be that simple, you can play around with Really Simple SSL more later.
Then go to the Cloudflare dashboard → Domains → your domain → Caching → Configuration → Purge everything.
This fixes redirect loops and “not secure” warnings. This was the “finally” moment where the site actually worked when typing in the URL.
Step 7 — Fix the homepage (permalinks)
One last WordPress quirk.
Go to:
Settings → Permalinks → Save Changes
You don’t need to change anything. Just saving regenerates rewrite rules so the homepage works behind the tunnel.
That’s it
Your WordPress site is now:
• Running from your home server
• Protected by Cloudflare
• Using HTTPS
• Not exposing your home network
• Not costing you monthly hosting fees
Exactly what I wanted from the start.
Why I like this setup
No open ports.
No VPS.
No monthly hosting bill.
Full control.
And now I have a place to write down the next homelab mistake so Future Me doesn’t have to relearn it.
Leave a Reply