Phase 1 Actions Log¶

curl -fsSL https://tailscale.com/install.sh | sh
tailscale up

tailscale ip -4
# → 100.89.70.63

ssh root@100.89.70.63
# ✅ Connection successful

# From 192.168.0.16:
curl -k https://192.168.0.200:8006   # ✅ Success
ssh root@192.168.0.200               # ✅ Success

# From phone:
# ❌ Not working (expected — firewall working correctly)

ping -c 3 1.1.1.1
# ✅ 3/3 packets received, 0% loss (~3.8ms avg)

ping -c 3 google.com
# ✅ 3/3 packets received, 0% loss (~4.0ms avg)

apt update && apt upgrade -y
# ✅ 21 packages upgraded

apt install curl
curl -fsSL https://get.docker.com | sh
# ✅ Docker 29.4.0 installed

mkdir -p /opt/edge-gateway && cd /opt/edge-gateway

services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: npm
    restart: unless-stopped
    ports:
      - "127.0.0.1:80:80"
      - "127.0.0.1:443:443"
      - "192.168.0.51:81:81"
    volumes:
      - ./npm/data:/data
      - ./npm/letsencrypt:/etc/letsencrypt

  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel --no-autoupdate --edge-ip-version 4 --protocol http2 run --token ${TUNNEL_TOKEN}
    depends_on:
      - npm
    network_mode: host

docker compose up -d npm
# ✅ NPM started

openssl rand -hex 32
# → 44c93188a2458ea<REDACTED>19e699607dcad28e7bf

docker compose up -d
# ✅ n8n running

[OPTIONS]
enable: 1

[RULES]
IN ACCEPT -source 127.0.0.1 -p tcp -dport 80,443 # cloudflared local to NPM
IN ACCEPT -source +admin_desktop -p tcp -dport 81  # NPM admin panel
IN DROP                                             # Block all other inbound
OUT ACCEPT -dest +router_gw -p udp -dport 53       # DNS resolution UDP
OUT ACCEPT -dest +router_gw -p tcp -dport 53       # DNS resolution TCP
OUT ACCEPT -dest 192.168.0.52 -p tcp -dport 5678   # Proxy to n8n-app
OUT ACCEPT -dest 192.168.0.53 -p tcp               # Proxy to biz-app (Phase 2)
OUT DROP -dest +lan_subnet                          # Block all other LAN
OUT ACCEPT -p udp -dport 7844                       # cloudflared QUIC to Cloudflare edge
OUT ACCEPT -p tcp -dport 7844                       # cloudflared HTTP/2 fallback
OUT ACCEPT -p tcp -dport 443                        # APIs / Let's Encrypt
OUT ACCEPT -p tcp -dport 80                         # HTTP fallback
OUT ACCEPT -p udp -dport 53                         # Public DNS fallback (1.1.1.1)
OUT ACCEPT -p tcp -dport 53                         # Public DNS fallback

[OPTIONS]
enable: 1

[RULES]
IN ACCEPT -source +edge_gw -p tcp -dport 5678  # Only edge-gateway may reach n8n
IN ACCEPT -source +admin_desktop -p tcp -dport 22  # SSH from admin desktop
IN DROP                                             # Block all other inbound
OUT ACCEPT -dest +router_gw -p udp -dport 53       # DNS resolution UDP
OUT ACCEPT -dest +router_gw -p tcp -dport 53       # DNS resolution TCP
OUT DROP -dest +lan_subnet                          # Lateral movement prevention
OUT ACCEPT -p tcp -dport 443                        # n8n external API calls (HTTPS only)

nano /opt/edge-gateway/.env
# TUNNEL_TOKEN=eyJhIjoi...<token>

docker compose up -d cloudflared
# ✅ Tunnel HEALTHY — connector registered in sin datacenter

Client ID:     3<REDACTED>b.apps.googleusercontent.com
Client Secret: GOCSPX-<REDACTED>-NhI

# From Proxmox host
pct stop 101
pct stop 102
pct snapshot 101 phase1-complete --description "Phase 1 complete — NPM + cloudflared"
pct snapshot 102 phase1-complete --description "Phase 1 complete — n8n 1.80.0"
# Turn on 'Start at boot' for both containers
pct start 101
pct start 102