A secure path into the server
Cloudflare Tunnel makes outbound connections from your server. GitHub uses a protected SSH route to deploy, and browsers use the portal route to view health.
Separate doors
The production AI address is unchanged. The owner view requires sign-in, while public health pages do not. These routes have separate access rules so a new login requirement cannot accidentally block NutsNews workers.
If the tunnel goes down
The local portal and remote deployments may become unreachable. Grafana Cloud and this independently hosted wiki remain available for investigation.