Cloudflare edge
Cloudflare sits in front of most *.saxobroko.com sites — SSL, WAF (block no aus), Access login for SaxDocs, and Pages for docs. Use this when the error mentions Cloudflare, 403, certificate, or Access.
CFL-001: Page shows Cloudflare error 1000 or 1016
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: DNS record missing, wrong target, or domain not on Cloudflare correctly — edge cannot find origin/tunnel. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Cloudflare-branded error page with a number like 1000, 1016, or "DNS resolution error." Likely cause: DNS record missing, wrong target, or domain not on Cloudflare correctly — edge cannot find origin/tunnel. Fix: 1. Note the exact error number and hostname. 2. Check Cloudflare DNS for that subdomain — see DNS & domains (DNS-015). 3. For homelab hosts, confirm CNAME to tunnel exists. 4. Wait five minutes after DNS fix — edge updates faster than global DNS cache.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Common Issues. Deep dive: Authentik
CFL-002: Error 502 Bad Gateway or 504 Gateway Timeout
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: cloudflared or the app on TrueNAS is down — Cloudflare reached the edge but not your home origin. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Cloudflare page says bad gateway or timeout; site worked before.
Likely cause: cloudflared or the app on TrueNAS is down — Cloudflare reached the edge but not your home origin.
Fix:
1. Test https://192.168.2.203 on home LAN.
2. Restart cloudflared — Restart cloudflared.
3. Restart the specific Docker app if only one subdomain fails.
4. Check status.saxobroko.com.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Cloudflare tunnel (TUN-001). Deep dive: Authentik
CFL-003: Error 403 — blocked outside Australia
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: block no aus WAF rule — homelab URLs are Australia-only by design. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Cloudflare block page when opening stream, dash, vault, etc. from overseas or some VPNs.
Likely cause: block no aus WAF rule — homelab URLs are Australia-only by design.
Fix:
1. Confirm you are testing from Australia without a non-AU VPN exit.
2. Understand this is expected for homelab hosts — not a bug to "fix" while travelling unless Saxon approves.
3. Public sites (docs, status, weather, blog) should work globally — if those 403, different issue (CFL-004).
4. Do not disable block no aus casually — security risk.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-004: docs.saxobroko.com 403 but I am in Australia
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: docs should be excluded from block no aus — misconfiguration, wrong hostname, or Bot Fight / Access issue instead of geo block. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: SaxDocs blocked with 403 despite being in AU; homelab URLs may work or not.
Likely cause: docs should be excluded from block no aus — misconfiguration, wrong hostname, or Bot Fight / Access issue instead of geo block.
Fix:
1. Confirm URL is exactly docs.saxobroko.com.
2. Check WAF skip rules for docs — WAF rules.
3. Try incognito — stale Access cookie can confuse.
4. See CFL-020 for Access login loop.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Open docs site. Deep dive: Authentik
CFL-005: What is block no aus in plain English?
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Custom WAF rule: if visitor is not from Australia, Cloudflare blocks access to most homelab subdomains. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Documentation mentions block no aus; you need a simple explanation.
Likely cause: Custom WAF rule: if visitor is not from Australia, Cloudflare blocks access to most homelab subdomains.
Fix:
1. Protects Jellyfin, arr, dash, vault, dsm, etc. from random global internet.
2. Does not* apply to intentionally public sites — see Public sites.
3. auth and docs have special exclusions for login worldwide.
4. New tunnel hostname must be added to the rule — WAF checklist.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See What is Cloudflare. Deep dive: Authentik
CFL-006: I added a new subdomain — still 403 from Australia
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Hostname not yet in localnet full strict ssl or WAF allow path; or wrong rule action blocking everyone. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: New app URL returns 403 even on home AU internet. Likely cause: Hostname not yet in localnet full strict ssl or WAF allow path; or wrong rule action blocking everyone. Fix: 1. Add hostname to localnet full strict ssl configuration rule. 2. Confirm hostname is in tunnel config (not legacy DNS). 3. Review WAF custom rules for accidental "block all" on that host. 4. Wait two minutes and test incognito.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See DNS-039 and WAF rules. Deep dive: Authentik
CFL-007: SSL handshake failed or ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: SSL mode mismatch on tunnel host — needs Full (strict) via localnet full strict ssl rule. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Browser cannot establish secure connection to a saxobroko.com subdomain.
Likely cause: SSL mode mismatch on tunnel host — needs Full (strict) via localnet full strict ssl rule.
Fix:
1. Cloudflare → Rules → Configuration rules → localnet full strict ssl.
2. Append (http.host eq "brokenhost.saxobroko.com") to expression if missing.
3. Ensure DNS record is proxied (orange cloud).
4. Retest after five minutes.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See CFL-010. Deep dive: Authentik
CFL-008: Too many redirects on login page
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Access + Authentik misconfiguration, or HTTP/HTTPS mismatch on tunnel origin URL. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Browser says redirect loop when opening dash or docs.
Likely cause: Access + Authentik misconfiguration, or HTTP/HTTPS mismatch on tunnel origin URL.
Fix:
1. Try incognito window — clear cookies for saxobroko.com.
2. Confirm tunnel service URL uses correct scheme (http vs https) for internal app.
3. For docs/dash, see Authentik troubleshooting.
4. Do not put auth.saxobroko.com behind Access (login loop).
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Login troubleshooting. Deep dive: Authentik
CFL-009: Cloudflare Access login page never appears for docs
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Access application misconfigured or bypass rule too broad — SaxDocs should use Access + Authentik. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: docs loads public content without login, or shows wrong page — expected Access gate missing.
Likely cause: Access application misconfigured or bypass rule too broad — SaxDocs should use Access + Authentik.
Fix:
1. Zero Trust → Access → Applications → verify docs.saxobroko.com app exists.
2. Confirm identity provider is Authentik OIDC — Authentik.
3. Test incognito from AU.
4. See Disable Access temporarily only if Saxon authorised emergency access.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Open docs site. Deep dive: Authentik
CFL-010: Certificate expired or not trusted on homelab subdomain
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Rare on proxied Cloudflare hosts — usually DNS-only (grey cloud) or origin cert issue on misconfigured host. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Browser warns certificate invalid for stream.saxobroko.com or similar proxied host.
Likely cause: Rare on proxied Cloudflare hosts — usually DNS-only (grey cloud) or origin cert issue on misconfigured host.
Fix:
1. Cloudflare DNS → confirm record is proxied orange.
2. Add host to localnet full strict ssl.
3. Universal SSL at Cloudflare edge should auto-cover saxobroko.com — check SSL/TLS → Edge certificates active.
4. If grey-clouded, re-enable proxy unless Saxon exception.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-011: Bot Fight Mode broke Cloudflare Access login
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Bot Fight Mode must stay OFF — it cannot be bypassed for Access OIDC. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: JS challenge or bot check instead of Authentik login; Access handshake fails. Likely cause: Bot Fight Mode must stay OFF — it cannot be bypassed for Access OIDC. Fix: 1. Cloudflare → Security → disable Bot Fight Mode for saxobroko.com zone. 2. Also check Zero Trust → Settings → Network if enabled there. 3. Retest docs/dash login in incognito. 4. Leave Bot Fight off if using Access + Authentik.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-012: Under Attack Mode accidentally enabled
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: I'm Under Attack Mode enabled zone-wide — overkill for homelab. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Every visitor sees interstitial "Checking your browser" even in Australia on trusted devices. Likely cause: I'm Under Attack Mode enabled zone-wide — overkill for homelab. Fix: 1. Cloudflare dashboard → Overview or Security → set to Low or Essentially off unless active attack. 2. Retest homelab URLs. 3. Document why it was enabled before turning off. 4. Prefer block no aus for geo restriction instead.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-013: Cloudflare challenge loop — keeps asking to verify human
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Bot Fight, high security level, or VPN IP flagged — overlaps with CFL-011. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Repeated CAPTCHA or JS challenge; never reaches app. Likely cause: Bot Fight, high security level, or VPN IP flagged — overlaps with CFL-011. Fix: 1. Disable Bot Fight Mode (CFL-011). 2. Disable VPN and retry from clean AU home connection. 3. Lower security level temporarily for test only. 4. Check WAF custom rules for "managed challenge" on that host.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Cloudflare account access. Deep dive: Authentik
CFL-014: How do I log into Cloudflare dashboard safely?
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Cloudflare account protected with hardware 2FA — credentials in Vaultwarden. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Need to change WAF or DNS; unsure login steps with YubiKey. Likely cause: Cloudflare account protected with hardware 2FA — credentials in Vaultwarden. Fix: 1. Follow Cloudflare account access. 2. Have YubiKey ready — desk YubiKey. 3. Select saxobroko.com zone after login. 4. Never paste API keys into tickets or SaxDocs.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-015: WAF rule blocked me by mistake in Australia
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Overly broad custom WAF rule, country detection glitch, or corporate VPN exit outside AU. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: 403 from AU IP on homelab URL that should work. Likely cause: Overly broad custom WAF rule, country detection glitch, or corporate VPN exit outside AU. Fix: 1. Disable VPN completely and retry on home NBN. 2. Cloudflare → Security → Events — find block reason for your request. 3. Adjust rule only if false positive confirmed — do not delete block no aus entirely. 4. Note rule ID and timestamp for Saxon.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Common Issues. Deep dive: Authentik
CFL-016: Security Events show thousands of blocks — is that bad?
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Normal internet background noise — bots scan every domain; block no aus blocks most non-AU probes. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Cloudflare analytics show many blocked requests; worry homelab is under attack. Likely cause: Normal internet background noise — bots scan every domain; block no aus blocks most non-AU probes. Fix: 1. No action needed if services work for you in AU. 2. Review events for targeted spikes only if services degrade. 3. Do not enable Under Attack Mode for noise alone (CFL-012). 4. Focus on actual user-visible outages.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Monitoring. Deep dive: Authentik
CFL-017: auth.saxobroko.com must not use Cloudflare Access
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: auth is the identity provider — putting it behind Access creates chicken-and-egg loop. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Login loop when Authentik itself is behind Access.
Likely cause: auth is the identity provider — putting it behind Access creates chicken-and-egg loop.
Fix:
1. Zero Trust → Access → ensure no Access app on auth.saxobroko.com.
2. Keep geo exclusions so OIDC callbacks work worldwide — WAF.
3. Protect individual apps (dash, docs) with Access instead.
4. See Authentik.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See CFL-008. Deep dive: Authentik
CFL-018: dash.saxobroko.com asks for Authentik login every time
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Browser blocking cookies, incognito use, or Access session duration set short — may be intentional security. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Homepage dashboard requires full login repeatedly; session does not stick.
Likely cause: Browser blocking cookies, incognito use, or Access session duration set short — may be intentional security.
Fix:
1. Use normal (not private) browser window if household policy allows.
2. Allow cookies for *.saxobroko.com.
3. Complete Authentik + YubiKey login once per session — Login troubleshooting.
4. Do not disable Access without Saxon.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Homepage for beginners. Deep dive: Authentik
CFL-019: vault.saxobroko.com blocked by WAF when travelling
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Vaultwarden is homelab host under block no aus — AU-only by design. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Cannot reach password vault abroad — 403 Cloudflare page.
Likely cause: Vaultwarden is homelab host under block no aus — AU-only by design.
Fix:
1. Expected abroad unless Saxon added exception — plan ahead with offline vault cache on phone.
2. Bitwarden apps may still serve cached vault if already logged in — test before trip.
3. Do not weaken geo block for convenience without risk acceptance.
4. auth and docs differ — see WAF exclusions list.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Open Vaultwarden. Deep dive: Authentik
CFL-020: Authentik login page shows but YubiKey step fails
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Wrong YubiKey, browser permission, or Bot Fight interfering — not DNS. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Cloudflare Access redirects to Authentik; WebAuthn/YubiKey prompt errors. Likely cause: Wrong YubiKey, browser permission, or Bot Fight interfering — not DNS. Fix: 1. Use supported browser (Chrome/Firefox recent). 2. Confirm Bot Fight off (CFL-011). 3. Try portable YubiKey procedure — portable YubiKey. 4. Fall back to documented backup auth if Saxon configured.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See What is 2FA. Deep dive: Authentik
CFL-021: Zero Trust vs regular Cloudflare dashboard — which to use?
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Websites → saxobroko.com for DNS/WAF/SSL; Zero Trust for Tunnels, Access apps, cloudflared tokens. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Confusion between orange Cloudflare site menu and Zero Trust for tunnels/Access. Likely cause: Websites → saxobroko.com for DNS/WAF/SSL; Zero Trust for Tunnels, Access apps, cloudflared tokens. Fix: 1. DNS/WAF/ssl → standard dashboard. 2. Tunnel hostname edits → Zero Trust → Networks → Tunnels. 3. Access login apps → Zero Trust → Access → Applications. 4. Same account login with YubiKey for both.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Cloudflare. Deep dive: Authentik
CFL-022: Page Rules or Redirect Rules conflict
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Legacy Redirect Rules or Page Rules still active from earlier site layout. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Unexpected redirect from one subdomain to another; old marketing redirect breaks app. Likely cause: Legacy Redirect Rules or Page Rules still active from earlier site layout. Fix: 1. Cloudflare → Rules → Redirect Rules and Page Rules — list all. 2. Match failing hostname — disable suspect rule temporarily. 3. Test incognito. 4. Document change before permanent delete.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See DNS & domains. Deep dive: Authentik
CFL-023: Always Use HTTPS breaks internal HTTP origin
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Edge Always Use HTTPS is fine — origin can stay HTTP behind tunnel; issue usually wrong internal URL scheme in tunnel config. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Redirect errors for tunnel pointing at http://192.168.2.203:PORT.
Likely cause: Edge Always Use HTTPS is fine — origin can stay HTTP behind tunnel; issue usually wrong internal URL scheme in tunnel config.
Fix:
1. Tunnel public hostname → service type HTTP to internal port unless app requires HTTPS locally.
2. Do not disable Always Use HTTPS zone-wide without reason.
3. Fix tunnel mapping — TUN-012.
4. Retest after cloudflared restart.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See cloudflared. Deep dive: Authentik
CFL-024: Cloudflare caching broke dynamic app (Sonarr/Radarr)
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Cloudflare caching dynamic admin UIs — should bypass cache for homelab apps. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Stale UI or API weirdness on arr apps through public URL. Likely cause: Cloudflare caching dynamic admin UIs — should bypass cache for homelab apps. Fix: 1. Cloudflare → Caching → Configuration — consider standard cache for homelab (often fine at default). 2. Add Cache Rule* bypass for admin subdomains if Saxon documented. 3. Hard refresh browser Ctrl+Shift+R. 4. Prefer LAN IP for heavy admin work when home.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-025: WebSockets fail through Cloudflare (real-time apps)
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Tunnel supports WebSockets by default — failure often origin app or timeout not WAF. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Live features hang; Jellyfin or other apps fail on public URL but LAN OK. Likely cause: Tunnel supports WebSockets by default — failure often origin app or timeout not WAF. Fix: 1. Confirm cloudflared running latest on TrueNAS. 2. Test same feature on LAN direct IP. 3. Check Cloudflare Network → WebSockets enabled (default on). 4. See Cloudflare tunnel (TUN-030).
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Media won't play. Deep dive: Authentik
CFL-026: Rate limiting blocked my home IP
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Temporary Cloudflare rate limit or WAF throttle from rapid testing. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: 429 or block after many refreshes during troubleshooting. Likely cause: Temporary Cloudflare rate limit or WAF throttle from rapid testing. Fix: 1. Stop hammering refresh for five minutes. 2. Check Security Events for rate limit rule. 3. Test from phone on mobile data (different IP) once. 4. Saxon can allowlist home IP if recurring — rare for homelab.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See CFL-015. Deep dive: Authentik
CFL-027: saxobroko.com apex homepage works — homelab subdomains do not
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Pages and tunnel are separate paths — apex OK does not imply cloudflared OK. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Main personal site on Pages loads; tunnel subdomains fail.
Likely cause: Pages and tunnel are separate paths — apex OK does not imply cloudflared OK.
Fix:
1. Run TUN-001 tunnel checklist.
2. Do not conflate Pages deploy status with TrueNAS health.
3. Check status.saxobroko.com for homelab monitors.
4. LAN test 192.168.2.203.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Network general (NET-016). Deep dive: Authentik
CFL-028: Cloudflare Pages build failed for docs.saxobroko.com
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: GitHub push failed CI, MkDocs build error, or Pages project disconnected — unrelated to TrueNAS tunnel. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: SaxDocs shows old content or deploy error email from Cloudflare Pages. Likely cause: GitHub push failed CI, MkDocs build error, or Pages project disconnected — unrelated to TrueNAS tunnel. Fix: 1. Cloudflare → Workers & Pages → SaxDocs project → Deployments → read build log. 2. Fix GitHub/MkDocs error if you have repo access — see SaxDocs FAQ when available. 3. Successful deploy auto-updates docs — no tunnel restart needed. 4. Custom domain must stay bound to project (DNS-012).
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Open docs site. Deep dive: Authentik
CFL-029: docs shows Access login but Authentik error after
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: OIDC client misconfiguration between Access and Authentik — not Pages build. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Cloudflare Access gate passes; Authentik returns error or invalid client.
Likely cause: OIDC client misconfiguration between Access and Authentik — not Pages build.
Fix:
1. Verify Authentik provider URLs match auth.saxobroko.com.
2. Confirm Bot Fight off (CFL-011).
3. See Authentik app providers.
4. Do not change auth DNS while debugging.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-030: Difference between Pages SSL and tunnel SSL
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Pages terminates SSL at edge automatically; tunnel origins need Full (strict) config rule for homelab hostnames. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Confusion why docs SSL "just works" but new tunnel host needs extra rule. Likely cause: Pages terminates SSL at edge automatically; tunnel origins need Full (strict) config rule for homelab hostnames. Fix: 1. docs → Pages custom domain — no localnet rule needed on origin. 2. stream/dash/etc. → add to localnet full strict ssl. 3. Both show valid browser padlock when correct. 4. Read WAF rules.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See CFL-007. Deep dive: Authentik
CFL-031: Temporary disable geo block for debugging
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Emergency debugging only — must re-enable after. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Saxon authorised short test without block no aus while abroad. Likely cause: Emergency debugging only — must re-enable after. Fix: 1. Follow Disable Access temporarily pattern for WAF — edit block no aus rule action or add skip with expiry note. 2. Document start/end time in private notes. 3. Re-enable AU block immediately after test. 4. Never leave homelab open globally by accident.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-032: Cloudflare API token needed for automation
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Tokens stored in Vaultwarden separately — not same as password login. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Script or CI asks for API token; you only have dashboard login. Likely cause: Tokens stored in Vaultwarden separately — not same as password login. Fix: 1. Search Vaultwarden for Cloudflare API — use existing token if documented. 2. Do not create new tokens without Saxon — old integrations may break. 3. Never commit tokens to GitHub or SaxDocs. 4. Rotate if accidentally exposed.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See GitHub if Saxon dies. Deep dive: Authentik
CFL-033: Email obfuscation or Cloudflare Email Routing
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Email routing is separate from tunnel/WAF — outage unrelated unless MX records deleted. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Questions about email addresses on saxobroko.com vs homelab outages. Likely cause: Email routing is separate from tunnel/WAF — outage unrelated unless MX records deleted. Fix: 1. Homelab down does not stop email unless MX broken (DNS-017). 2. Check MX records before blaming tunnel. 3. See registrar/Cloudflare email settings if mail-specific issue. 4. Focus CFL FAQs on web apps unless mail explicitly fails.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See DNS-017. Deep dive: Authentik
CFL-034: weather.saxobroko.com and status.saxobroko.com — Cloudflare role?
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: DNS names in zone may still pass through Cloudflare proxy depending on record — often public not homelab geo blocked. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Unsure if WAF rules on saxobroko.com zone affect external status/weather hosts. Likely cause: DNS names in zone may still pass through Cloudflare proxy depending on record — often public not homelab geo blocked. Fix: 1. Read Public sites and Monitoring. 2. These are not TrueNAS tunnel apps — different failure modes. 3. Use status to diagnose homelab — not vice versa. 4. 403 abroad on status would be unusual — investigate separately.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Check status page. Deep dive: Authentik
CFL-035: Deployed SaxDocs change not visible on docs.saxobroko.com
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Pages deploy lag, browser cache, or build from wrong branch. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Git push succeeded; live site shows old FAQ or missing page. Likely cause: Pages deploy lag, browser cache, or build from wrong branch. Fix: 1. Cloudflare Pages → latest deployment → confirm Success timestamp. 2. Hard refresh or incognito. 3. Confirm production branch matches GitHub default. 4. Access login may cache redirects — clear cookies if navigation broken only.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See CFL-028. Deep dive: Authentik
CFL-036: Mixed content warnings on public site
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Old embedded http:// links in markdown or homepage — not tunnel issue.
Diagnose (2 min):
1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook.
2. Check Service matrix for which app/host owns the broken URL.
3. If a single device only, retry from a second device on the same network.
Symptoms: Browser blocks HTTP assets on HTTPS saxobroko.com page.
Likely cause: Old embedded http:// links in markdown or homepage — not tunnel issue.
Fix:
1. Fix source content to use https:// links.
2. Redeploy Pages project.
3. Homelab apps should always be accessed via https:// public URLs.
4. Not fixed by UniFi changes.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Public sites. Deep dive: Authentik
CFL-037: Cloudflare Access policy — who can log into docs?
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Access policy email/group list does not include them — separate from Authentik user existing. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Family member denied Access to SaxDocs though they have Authentik account. Likely cause: Access policy email/group list does not include them — separate from Authentik user existing. Fix: 1. Zero Trust → Access → Applications → docs app → Policies. 2. Add user email or group per Saxon's handover plan. 3. Also ensure Authentik user exists — Add Authentik user. 4. Test incognito with their account.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-038: Firewall rule on Cloudflare blocked API webhook
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: block no aus blocks non-AU webhook sources — integration must use AU endpoint or exemption. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: External service cannot callback to homelab URL; 403 in Cloudflare logs. Likely cause: block no aus blocks non-AU webhook sources — integration must use AU endpoint or exemption. Fix: 1. Identify webhook source country in Security Events. 2. Saxon may add WAF skip for specific path/host — not DIY for beginners. 3. Prefer LAN-only integrations where possible. 4. Document which apps need global webhooks.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
CFL-039: Cloudflare outage — all saxobroko.com down globally
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Rare Cloudflare edge/platform outage — homelab LAN may still work locally. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Cloudflare status page reports incident; every proxied site fails together.
Likely cause: Rare Cloudflare edge/platform outage — homelab LAN may still work locally.
Fix:
1. Check cloudflarestatus.com.
2. Use LAN IPs at home (192.168.2.203) while waiting.
3. Do not reboot TrueNAS repeatedly for Cloudflare-side outage.
4. Retry public URLs when Cloudflare clears incident.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See External Cloudflare when site down. Deep dive: Authentik
CFL-040: HSTS or certificate pinning confusion
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Valid Cloudflare certs should not trigger this — if they do, fix SSL config not bypass HSTS. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Browser refuses to let you bypass cert warning on test subdomain.
Likely cause: Valid Cloudflare certs should not trigger this — if they do, fix SSL config not bypass HSTS.
Fix:
1. Fix root SSL issue (CFL-010) — do not hack browser exceptions for production hosts.
2. Enable HSTS only when stable — Saxon managed.
3. Test with curl -I https://host if comfortable or ask Saxon.
4. Use incognito for clean test.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See CFL-007. Deep dive: Authentik
CFL-041: New family member needs Access to dash and docs
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Needs Authentik account + Access policy + YubiKey/handover credentials per Saxon's plan. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: Ryan or family needs login to homepage and SaxDocs from their phone. Likely cause: Needs Authentik account + Access policy + YubiKey/handover credentials per Saxon's plan. Fix: 1. Create Authentik user — Add user guide. 2. Add to Cloudflare Access policies for dash and docs apps. 3. Train on Vaultwarden and YubiKey if issued. 4. Test from their device on AU network.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See Handover who gets what. Deep dive: Authentik
CFL-042: Checked Cloudflare edge — still broken
Stack context: Cloudflare WAF · SSL · Access · Pages Integrated runbooks: Auth stack · WAF
Why this happens: Problem is tunnel or app layer below Cloudflare — escalate with error code and timestamp. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.
Symptoms: WAF, SSL, Access, Pages all seem fine; user-visible error persists. Likely cause: Problem is tunnel or app layer below Cloudflare — escalate with error code and timestamp. Fix: 1. Collect: exact URL, error code (403/502/525), AU or abroad, LAN works Y/N. 2. Run Cloudflare tunnel (TUN-040) full checklist. 3. Restart cloudflared once — not ten times. 4. See Common Issues before destructive changes.
Verify: Repeat the original symptom check — it should be gone or clearly improved.
Still broken? See FAQ overview. Deep dive: Authentik