Secure Exposure of REST APIs in Homelab Environments using Cloudflare Tunnel

• Ulisses Thorwald Moraes Guedes UNIPAMPA
• Eduardo Cabezudo Vilhalba UNIPAMPA
• Danielly Cristina do Carmo Neves UNIPAMPA
• Silvio E. Quincozes UNIPAMPA

DOI: https://doi.org/10.5753/sbseg_estendido.2026.29807

Resumo

The rising cost of cloud platforms has motivated students, hobbyists, and small teams to host low-demand applications in homelabs. Although this approach reduces costs and supports practical learning, exposing services from residential networks introduces security and availability risks. This paper presents a case study on securely exposing a homelab-hosted REST API using secure backend practices, a Dokku-managed Linux virtual machine, PostgreSQL, SSH hardening, and Cloudflare Tunnel. The results indicate that this architecture is a low-cost and replicable alternative for small applications, reducing direct network exposure while preserving encrypted access, centralized traffic handling, and a smaller attack surface.

Referências

Broadcom (2026). VMware ESXi Installation and Setup Documentation. [link]. Accessed: 2026-06-04.

Brush, A. J. B., Jung, J., Mahajan, R., and Scott, J. (2012). Homelab: Shared infrastructure for home technology field studies. In Proceedings of the 2012 ACM Conference on Ubiquitous Computing. ACM.

Cloudflare (2026). Cloudflare Tunnel Documentation. [link]. Accessed: 2026-06-04.

Dokku (2026a). Deploying an Application. [link]. Accessed: 2026-06-04.

Dokku (2026b). Dokku PostgreSQL Plugin. [link]. Accessed: 2026-06-04.

Ferretti, L., Magnanini, F., Andreolini, M., and Colajanni, M. (2021). Survivable zero trust for cloud computing environments. Computers & Security, 110:102419.

OWASP Foundation (2023). OWASP API Security Top 10 – 2023. [link]. Accessed: 2026-0604.

PostgreSQL Global Development Group (2026). PostgreSQL Documentation. [link]. Accessed: 2026-06-04.

Rose, S., Borchert, O., Mitchell, S., and Connelly, S. (2020). Zero trust architecture. Technical Report NIST Special Publication 800-207, National Institute of Standards and Technology.

Sacramento, L. S. C. et al. (2024). Automação de autenticação para testes de segurança em aplicações web no zap. In Anais do XXIV Simpósio Brasileiro de Cibersegurança, pages 1–14. Sociedade Brasileira de Computação.

Syed, N. F., Shah, S. W., Shaghaghi, A., Anwar, A., Baig, Z., and Doss, R. (2022). Zero trust architecture (zta): A comprehensive survey. IEEE Access, 10:57143–57179.

Tanveer, F. et al. (2025). Towards secure apis: A survey on restful api vulnerability detection. Computers, Materials & Continua, 84(3).

Ubuntu (2026). OpenSSH Server Documentation. [link]. Accessed: 2026-06-04.