expose-private-service

仓库创建 2026年7月27日最近提交 1 天前SkillHot 收录 1 天前

▸ 精选理由

提供实战级的 Traefik+Cloudflare 暴露模式，适合家庭/自托管用户。

▸ 风险提示

需要 Cloudflare API 密钥/证书与 DNS 权限，涉及敏感凭据。

这个 Skill 做什么

通过 Traefik 与 Cloudflare 将仅内网服务安全暴露为 HTTPS。

把只在内网的自家服务通过 HTTPS 安全对外访问：用主机级 Traefik 终止 TLS，并配合 Cloudflare DNS（DNS‑01）和通配证书，不需要把服务绑定到 0.0.0.0。适合 Tailscale、WireGuard、局域网或云 VPC 的私有服务（含 Docker Compose），重点是不把服务暴露到公网。

▸ 展开 SKILL.md 英文原文

Expose a private-network-only homelab service over HTTPS through an existing Traefik reverse proxy and Cloudflare DNS, using a trusted wildcard cert. Use when adding a new self-hosted service (Docker Compose or otherwise) that should be reachable only over a private network (Tailscale, WireGuard, plain LAN, a cloud VPC's private subnet, etc.), not the public internet.

开发编程TraefikCloudflare反向代理通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/CervantesVive/agent-skills/main/skills/infra/expose-private-service/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/CervantesVive/agent-skills/main/skills/infra/expose-private-service/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Expose a private-network-only service via Traefik + Cloudflare DNS

This pattern works for a host that runs services bound directly to a private
IP (never `0.0.0.0`), fronted by a single host-level Traefik instance that
terminates HTTPS with a wildcard Let's Encrypt certificate for a domain like
`*.home.example.com` (obtained via Cloudflare DNS-01 challenge — no port
80/443 validation needed, so the cert doesn't require public reachability).

"Private IP" is intentionally generic: any address not routable from the
public internet works — a Tailscale/WireGuard overlay address, a plain LAN
IP, a cloud VPC's private subnet address, etc. The reference implementation
below (`scripts/expose.sh`)

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有