Cloudflare Tunnel + Traefik — Zero Open Ports, Full Public Access
admin
Cloudflare Tunnel plus Traefik expose every service publicly with zero open ports on the router — automatic HTTPS and per-route auth included.
Networking
Authentik — SSO & Forward Auth in Docker
Authentik puts every service behind one login — password plus TOTP, optional Plex sign-in, session shared across every subdomain via Traefik forward auth.
Gluetun — One VPN Container to Route Them All
How to run a single Gluetun container as a VPN gateway for your entire arr stack — one WireGuard tunnel, every container protected, with port forwarding and a kill-switch built…