How this site got built.

The map

Two paths matter. The visitor path is what happens when you load this page. The operator path is how changes get made. Neither path ever touches an open port on a server.

01Buying the domain with code

Cloudflare's Registrar API (a beta since April 2026) lets a script search, check and register domains. That turns "go buy a domain" into three HTTP calls.

1. Search every extension for the cheapest priceThe API supports a little over 400 extensions. A script price-checked one name against all of them, 20 at a time. The cheapest first year was $4.99, but those renew at $25 to $42. .fyi was $5.20 for the first year and $5.20 every year after.
2. Check again right before buyingSearch results are cached. The check call asks the registry directly, and the script refuses to buy if the price or availability has changed.
3. A human says yesRegistrations can't be refunded, so the operator approved the exact domain and price first. Automation does the work, and a person signs off on spending money.
4. RegisterOne POST. It finished in about ten seconds, with WHOIS privacy on by default and the domain locked against transfers.

# 1. availability + price (read-only, free)
curl -X POST $API/accounts/$ACCOUNT/registrar/domain-check \
  -H "Authorization: Bearer $REGISTRAR_TOKEN" \
  -d '{"domains":["jamalbuilds.fyi"]}'
→ {"registrable":true,"tier":"standard",
   "pricing":{"registration_cost":"5.20","renewal_cost":"5.20"}}

# 2. buy it (charges the account's card, non-refundable)
curl -X POST $API/accounts/$ACCOUNT/registrar/registrations \
  -H "Authorization: Bearer $REGISTRAR_TOKEN" \
  -d '{"domain_name":"jamalbuilds.fyi","years":1,"auto_renew":false}'
→ {"state":"succeeded","completed":true}

Because the domain was bought at Cloudflare, its DNS zone already existed on the account, with Cloudflare's nameservers set, so there was no nameserver step. The one wait was the .fyi registry itself, which publishes a new domain's delegation a little after the sale. Until it does, every resolver on earth answers "no such domain".

02The bastion host

A bastion is the one machine trusted to administer the others. Here it is a $5/month VM that runs Claude Code inside tmux, so the operator can drive it from a phone.

# ~/.ssh/config: SSH rides through Cloudflare, never a public IP
Host bastion
  HostName   ssh.<bastion-domain>
  User       jamal
  ProxyCommand cloudflared access ssh --hostname %h

Least privilege on the web server

The bastion logs into the web server as an ordinary user. The only root actions it can take are one helper script that edits the tunnel config, through a narrow sudoers rule. That helper:

• validates the new config before using it,
• backs up the old one,
• restarts the tunnel, and rolls back automatically if it isn't healthy within 20 seconds,
• refuses to touch routes that belong to other apps on the same server.

03The web server

The server already runs other sites. Each one is a container that only listens on 127.0.0.1, so it can't be reached from outside even if a firewall rule slipped.

# ~/.config/systemd/user/jamalbuilds.service (abridged)
ExecStart=/usr/bin/podman run --rm --name jamalbuilds-web \
  -p 127.0.0.1:9380:80 \
  -v %h/jamalbuilds/site:/usr/share/nginx/html:ro,z \
  docker.io/library/nginx:1.27-alpine
Restart=always

04Tunnel and DNS

A Cloudflare Tunnel is a long-lived outbound connection from the server to Cloudflare. Requests for a hostname travel back down that connection. Adding a site means two changes: one route in the tunnel config, and one DNS record.

# tunnel ingress rules (first match wins)
ingress:
  ...
  - hostname: jamalbuilds.fyi
    service:  http://127.0.0.1:9380
  - hostname: www.jamalbuilds.fyi
    service:  http://127.0.0.1:9380
  - service: http_status:404      # everything else

# applied through the guarded helper
sudo jbops-tunnel show > c.yml     # edit c.yml
sudo jbops-tunnel check < c.yml    # validate
sudo jbops-tunnel apply < c.yml    # back up, restart, auto-rollback

Then DNS. Both names become proxied CNAMEs pointing at the tunnel. "Proxied" means the public answer is a Cloudflare address, so the server's real IP is never published.

curl -X POST $API/zones/$ZONE/dns_records \
  -H "Authorization: Bearer $DNS_TOKEN" \
  -d '{"type":"CNAME","name":"jamalbuilds.fyi",
       "content":"<tunnel-id>.cfargotunnel.com","proxied":true}'

A CNAME at the zone apex normally isn't allowed. Cloudflare "flattens" it into A/AAAA answers on the fly.

05Where "serverless" comes in

There is a server here, but nobody on the internet ever talks to it. From the visitor's side, everything public is a Cloudflare service:

How long it took

Measured on 12 November 2026, in UTC. The clock starts when the operator approved the purchase and stops when this page loaded over HTTPS.

About three-quarters of the time was waiting on third parties: the registry and the certificate authority. Everything that needed doing took under five minutes.

Earlier the same morning