VPS lockdown: Cloudflare only, SSH over Tailscale
With Docker, ufw doesn’t help: visitors reach your site only through Cloudflare, and only you SSH in, over Tailscale.
1.2K saves on X, as of Posted
Prompt
First check that my domain is proxied through Cloudflare and this server serves HTTPS on 443. Then install Tailscale and join this server to my tailnet. Lock the firewall down: 443 only from Cloudflare's IP ranges, SSH 22 only from Tailscale, everything else closed, including ports Docker publishes. Keep public SSH open until I confirm I can log in over Tailscale. When you're done, show me how to check from outside that it worked.Next Send it to Claude Code or Codex on the server.
With Docker, ufw doesn’t help. The ports your containers publish go straight around it. Key-only SSH login isn’t enough either. When sshd itself has a vulnerability, attackers still get in.
If your domain already goes through Cloudflare’s proxy, open Claude Code or Codex on the server and send it the prompt. Once it’s done, visitors can only reach your site through Cloudflare, and only you can SSH in, over Tailscale.
Share this tip
