Understand the concept
A cloudflared connector creates outbound connections to Cloudflare. A published application route links the public hostname to a local HTTP service.
The connector needs network access to its origin: host-network mode can reach an Nginx port bound to 127.0.0.1 on the host. Tunnel credentials must remain secret and should be rotated if exposed.
TRY IT YOURSELF
Practice task
Write down which parts of the website are public, and confirm Proxmox management stays private.
CHECK YOUR UNDERSTANDING