Cerb used to listen on 0.0.0.0 for API and Admin. The public edge was already Cloudflare Tunnel, but the host still accepted connections on every interface. More trust than a living-room box needs.
I moved tunnel origins onto Docker DNS (cerb-cms-api, cerb-cms-admin) with cloudflared on the Compose network, bound published ports to 127.0.0.1, and enabled ufw (SSH open; Portainer only from the LAN). Ollama got parked in the same cleanup.
The 502 lesson: pointing published routes at http://127.0.0.1:3002 while cloudflared runs in Docker means “talk to myself,” not “talk to the host.” Site went dark until I pointed origins at the Compose service names again.
NAT already made WAN probes time out. Loopback + tunnel DNS + ufw make the intent obvious if something else on the LAN gets curious. Longer ops notes live in docs/ops.md.