[Preparation] Setting up domains and DNS with Cloudflare

― Before safely exposing self-hosted AI and local services

In recent years, the number of people running
AI agents and self-hosted tools on VPS or home servers has surged.

However, at the same time,

• leaving ports wide open

• exposing Web UIs without authentication

• exposing your IP address directly to the internet

and other examples of operating in extremely dangerous states are frequently seen.

In this article, I will explain
what you must do as a preliminary step before starting full-scale security measures—

— in a way that is easy for beginners to understand.

※ This article provides the
prerequisite knowledge and environment setup
needed to understand and implement a secure configuration using Cloudflare Tunnel / Access.

Why are Cloudflare and a domain necessary at the start?

The
Zero Trust / Tunnel / Authenticated Exposure methods explained in subsequent articles require:

• a custom domain

• DNS managed by Cloudflare

as a prerequisite.

Things you cannot do without a domain

• HTTPS (automatic certificate management)

• Subdomain separation (service / admin / webhook)

• Authenticated exposure (Cloudflare Access)

• Private port operation (Cloudflare Tunnel)

👉 **In short, a domain is the "foundation of security."**

1️⃣ Create a Cloudflare account

First, create a free Cloudflare account.

👉 https://dash.cloudflare.com/sign-up

All you need is:

• Email address

• Password

That is all.

2️⃣ How to prepare a domain

Method 1: Purchase a domain directly through Cloudflare (Recommended)

Cloudflare is also a domain registrar.
*Cloudflare Domains offers lower domain prices.

Steps

1. Cloudflare Dashboard

2. Registrar → Register Domains

3. Search for the domain name you want to acquire

4. Check the price and purchase

Benefits of this method

• DNS settings are reflected immediately

• No need for nameserver configuration

• WHOIS Privacy is free

• Excellent compatibility with Tunnel / Access

👉 This is the safest and easiest method for beginners.

Method 2: Using a domain you already own

You can also use domains you have already acquired via
Onamae.com / Google Domains / Route53, etc.

In that case, you will need to:

• Add the domain to Cloudflare

• Change the nameservers to Cloudflare

is required.

3️⃣ Add a domain to Cloudflare

In the Cloudflare dashboard:

1. Websites → Add a site

2. Enter your domain name

3. Select the Free plan

Cloudflare will automatically scan your existing DNS.

4️⃣ Change nameservers to Cloudflare

Cloudflare will provide you with
dedicated nameservers like the ones below.

xxxx.ns.cloudflare.com
yyyy.ns.cloudflare.com

Please change to these nameservers in your
domain registrar's settings screen.

* It may take from a few minutes up to 24 hours for changes to propagate.
* If you acquired the domain through Cloudflare, this step is not necessary.

5️⃣ Basic DNS configuration policy (Important)

This is the most important concept.

Example of what not to do

• Registering the VPS IP in an A record

• Exposing the management screen directly

Recommended approach

• Decide on the subdomain first

• Control the actual entity (connection destination) on the Tunnel side

6️⃣ Example of subdomain design

Usage Subdomain Main Service
www.example.com
hoge.example.com
*Cloudflare Access cannot be used unless the subdomain is one level deep.

👉 In the following article,
we will assign this subdomain to Tunnel / Access.

7️⃣ Check SSL / HTTPS settings

Cloudflare Dashboard:

• SSL/TLS → Overview

• Mode: Full or Full (strict)

When using Tunnel,
certificate management is handled automatically by Cloudflare.

8️⃣ Check the Zero Trust dashboard

To use it in the next article,
confirm that you can access the Zero Trust dashboard.

👉 https://one.dash.cloudflare.com/

• The organization name can be a placeholder

• The free plan is sufficient.

9️⃣ Current status (checklist)

Item Status Cloudflare Account ✅ Domain acquired or transferred ✅ DNS management is Cloudflare ✅ Subdomain design ✅ Zero Trust available ✅

🔜 Next article to read (main content)

Once you have completed this, you can
implement the content of the next article safely and reliably.

👉
[Warning] Clawd.bot security incidents have already begun - Learning from X's warning posts, the correct defense configuration [Complete Edition]

✅ Summary

• Cloudflare and domains are prerequisites for security configuration

• Designing so that IPs are not directly exposed is crucial

• If you skip this, subsequent measures will not be effective