Every public request to one of my sites used to go through a Cloudflare tunnel. I had a cloudflared deployment in my cluster, some routing rules, and everything just worked. And it was free! But that bugged me. TANSTAAFL right? The whole point of selfhosting is to not rely on big cloud company, and there are few bigger than Cloudflare. And Cloudflare’s tunnels decrypt every single packet, so they see everything you do. I really don’t like that.
So I’ve replaced Cloudflare tunnels with Erwan Leboucher’s towonel, a selfhosted tunnel implementation. I still have my DNS on Cloudflare, but no data is moving through them any more.
…
Why keep DNS on Cloudflare?? Quad9 is where it’s at! Supports DNSSEC, DoT or DoH, QUIC, no log, no BS.
Want it on your phone out and about (and not already using a VPN?) https://dns.quad9.com/dns-query or use the app.
I believe OP would require an authoritative DNS server, which AFAIK Quad9 is not. desec.io would be my recommendation though.
Yeah, that’s a future step. I just haven’t finished migrating everything.