Taking the HomeLab on the Road
Travel has a way of exposing every shortcut in a HomeLab. When I am away with the M5 MacBook, I want to reach the Mac mini and my Skynet cluster as if I never left, without opening a single port on my router. This is Part 1 of a short series on how Cloudflare Tunnel and WARP make that work, plus a few more locks I put on the cluster this week.
There are two kinds of things I need on the road:
- The Mac mini itself, for SSH and Screen Sharing. That stays private. No public hostname, and Screen Sharing is never port-forwarded.
- The cluster’s web pages, which already come in through Cloudflare.
The Mac mini: a private road with WARP
On the mini, a second Cloudflare tunnel called mac-mini-private runs as a root LaunchDaemon, so it starts at boot, before anyone logs in. It does not publish a website. It routes exactly one private address, the mini’s own spot on my home network, and nothing else.
On the M5, the Cloudflare WARP client is enrolled in my Zero Trust organization, and only my approved email addresses can enroll a device. WARP’s split tunnel leaves the rest of my home network alone and sends just the mini’s address through Cloudflare to that tunnel.
So from a hotel or a phone hotspot, I connect WARP, then SSH to the mini or open Screen Sharing using its normal home address. I tested both over my phone hotspot before a trip, and both worked on the first try. Very slick.
One gotcha. With WARP connected at home, the M5 sent its traffic for the mini out through Cloudflare, and the mini lost its direct link to the laptop. My battery check on the mini could not reach the M5 anymore. So WARP stays off while I am home, and turning it back on is on my packing list.
The cluster: one tunnel, four more locks
Skynet comes in through its own tunnel. The cloudflared pods run inside the cluster, one wildcard DNS record points at the tunnel, and the tunnel hands everything to Traefik. No MetalLB and no open ports. The catch with a wildcard: any new Ingress is reachable from the internet the moment Flux applies it.
n8n and my home dashboard already had a lock, Cloudflare Access with a one-time code emailed to me. That story is in A Locked Front Door, so I won’t repeat it here.
This week I wanted four more pages on the dashboard: Longhorn, Prometheus, Alertmanager and SearXNG. Longhorn has no login of its own at all, so the order mattered. Locks first, doors second. Last Sunday morning, four new Access apps went in through Cloudflare’s API, each a copy of the n8n one: the same “Allow James emails” policy, the emailed one-time code, and 24-hour sessions. A quick curl to each new hostname came back with a redirect to my Cloudflare login page. Only then did the pull request with the four new Ingresses get merged, and Flux rolled them out that afternoon.
Side by side
| What | How I get there | Who gets in |
|---|---|---|
| Mac mini (SSH and Screen Sharing) | mac-mini-private tunnel on the mini, WARP on the M5 | Only a device enrolled in my Zero Trust org, no public hostname |
| n8n and the home dashboard | skynet tunnel, wildcard DNS to Traefik | Cloudflare Access, emailed one-time code, 24-hour session |
| Longhorn, Prometheus, Alertmanager, SearXNG | skynet tunnel, wildcard DNS to Traefik | Cloudflare Access, same policy, added before the Ingresses went live |
Before I leave
- Connect WARP on the M5 and check SSH to the mini before heading out the door.
- Every new hostname gets its own Access app before its pull request merges. With a wildcard record, no lock means no merge.
Next up in the series: a closer look at the private road to the Mac mini. Another step closer to a HomeLab I can take anywhere.