cloudflared

The tunnel said 502 while every container was green. Compose DNS only knows service names, and a six-line alias solved it in one step.

TL;DR: Public URL returned 502 while everything looked healthy and curl to the proxy worked fine. Ingress pointed to proxy on port 8199 but the service is actually plane-proxy, so Docker DNS had no record and cloudflared couldn't reach the origin. Adding a network alias proxy to plane-proxy fixed it, keeping the name stable for anything outside the repo.

A 13-service Plane stack on a single-admin VPS: a cloudflared sidecar as the only public door, bind-mounted state, and no public host ports.

TL;DR: Running Plane on a packed VPS clashed with its default host ports 80 and 443. I kept the 13-service stack fully internal and exposed it only via a Cloudflare Tunnel sidecar aimed at the proxy, not port 8000 which is just the API. This keeps the firewall to SSH only, handles TLS at the edge, and removes public port exposure.