Public access

Public access (Cloudflare Tunnel + Discord sign-in)

Optional. People open Nyerk at your own domain; no port is opened on your router and your home IP stays hidden. Everyone signs in with Discord, so there are no accounts or passwords to hand out.

Who can do what once it's open: Access levels.

1. Your domain on Cloudflare. Add the domain at dash.cloudflare.com (Free plan) and switch its nameservers at your registrar to the two Cloudflare gives you. Wait until it shows Active.

2. Discord sign-in. In the Developer Portal → your app → OAuth2, add the redirect https://nyerk.example.com/auth/callback (your domain) and copy the Client ID and Client Secret.

3. The tunnel. In Cloudflare Zero Trust → Networks → Tunnels → Create a tunnel (Cloudflared), and copy the token from the Docker command it shows (the part after --token). Add a published application: nyerk + your domain → Service URL http://nyerk:8080. That port is plain HTTP inside the stack only and is never published; visitors still get HTTPS from Cloudflare.

4. Env. Add to the stack's env and deploy:

PUBLIC_URL=https://nyerk.example.com
DISCORD_CLIENT_ID=…
DISCORD_CLIENT_SECRET=…
OWNER_IDS=your-discord-user-id
ADMIN_ROLE_IDS=role-id-of-your-admins
COMPOSE_PROFILES=tunnel
TUNNEL_TOKEN=…
WEB_BIND=127.0.0.1:8443   # optional: stop publishing the port on your LAN

Check: the stack shows a nyerk-tunnel container, the nyerk log says Tunnel listener on http://nyerk:8080, and your address shows the sign-in page.

Problem	Fix
No nyerk-tunnel container	COMPOSE_PROFILES=tunnel missing, or an old compose.yaml; paste the current one
nyerk-tunnel warns Group ID 65532 is not between ping group / ICMP proxy feature is disabled	Harmless (it only affects ping through the tunnel, not the website). The current compose.yaml silences it; paste it and redeploy
502 Bad Gateway, log says connection refused	PUBLIC_URL not set, or an old compose.yaml that doesn't pass it to Nyerk
Error 1033	The tunnel container isn't running, or the token is incomplete
Discord: Invalid OAuth2 redirect_uri	The redirect and PUBLIC_URL must match exactly, including https://

5. Cloudflare protection (free plan, your domain's dashboard):

• Security → WAF → Rate limiting rules: when URI Path starts with /auth or /login, 10 requests per 1 minute per IP → Block for 10 minutes.
• Security → Bots: turn on Bot Fight Mode.
• Security → Settings: keep Security Level at Medium; switch on I'm Under Attack if you're ever flooded.

6. Keep the containers off your LAN (recommended, Linux host). Even if someone found a hole in Nyerk, the container can't reach your router, NAS or other machines. Replace 192.168.0.0/16 with your LAN range:

sudo iptables -I DOCKER-USER -s 172.30.70.0/24 -d 192.168.0.0/16 -m conntrack --ctstate NEW -j DROP
sudo apt install iptables-persistent && sudo netfilter-persistent save   # keep it after reboots

Already built in: Discord sign-in reads only your name and ID and discards the token; sessions last 12 hours and are re-checked against your server roles; owner-only changes need a sign-in from the last hour; password sign-in is refused through Cloudflare; per-IP and per-account rate limits (see Access levels) and a 2 MB request cap; strict security headers and HSTS; links, invites and @everyone/@here are refused in all text; every change is recorded in Settings → Change history with one-click restore and posted to #logs; the container runs read-only, as a normal user, with all privileges dropped.

If an admin account looks compromised: Settings → Access and security → Lock admin access (instant), then Change history to restore anything they changed, then remove their role in Discord.

Terms and privacy: every copy serves /terms and /privacy (linked in the page footer, no sign-in needed). Paste https://nyerk.example.com/terms and https://nyerk.example.com/privacy (your domain) into the Developer Portal → your app → General Information → Terms of Service URL and Privacy Policy URL.

Pasting your address in Discord shows a link preview; its title and text are under Settings → Link preview.