Skip to content
Buddy Cluster
buddy-cluster.dev

Get your connection ready

What this gets you

Your connection confirmed ready to publish services — reachable by domain name, over valid HTTPS — without you needing to know what CGNAT, DDNS or a certificate authority are. Nothing is published by doing this alone.

Before you start

  • A domain name, with its DNS managed by Cloudflare (a free plan is enough). Buddy uses Cloudflare for both routing your domain and issuing certificates.
  • A Cloudflare API token, scoped as the wizard asks:
    • Zone:DNS:Edit and Zone:Zone:Read, always.
    • Cloudflare Tunnel:Edit too, if your connection needs the tunnel option below.
  • If your router allows it, access to its port-forwarding settings.

The steps

  1. Open Exposure → Configuration and start Guided setup. (You can also say yes to this same step when it’s offered during initial cluster setup. It’s identical.)

  2. Read the overview of what’s needed and roughly how long it takes.

  3. Let Buddy detect how traffic can reach you, and accept its recommendation, or pick manually:

    • Port-forward: recommended if you have a real public IP. Forward TCP 80 and 443 on your router to the master’s LAN address, and give the master a DHCP reservation so that address doesn’t change. Buddy tries to set the forward automatically; if it can’t, it shows the exact manual steps for your situation.
    • Tunnel: recommended if you’re behind CGNAT (many residential connections are). No router changes needed: Buddy runs a small connector that dials out to Cloudflare on your behalf.

  4. Move your domain’s DNS to Cloudflare if it isn’t already, create an API token with the permissions shown on screen, and paste it in. Buddy validates it against your domain immediately and tells you exactly what’s missing if it doesn’t work.

    Already running your own cloudflared tunnel? Open Advanced: use my own tunnel and paste its connector token instead; Buddy configures it but won’t create, manage or delete it.

  5. Watch Buddy set everything up, with a live checklist and a Retry if any step fails: safe to retry, nothing is duplicated.

How you know it worked

In tunnel mode, the screen shows connected as soon as Cloudflare reports it. In port-forward mode, readiness confirms itself the first time you publish a service and its certificate issues successfully. There’s no separate check to run here.

What can go wrong

  • Port-forward shows “Not reachable yet” / readiness never confirms
  • Behind CGNAT, use the tunnel
  • A DDNS-only provider can’t get a certificate behind CGNAT

See these symptoms in Troubleshooting.

What’s next

Continue to Publish a service.