Step 5 of 10

Domain or home network

Decide before you install: HTTPS from anywhere with your own domain, or LAN mode in your home network only.

	Domain mode	LAN mode
Dashboard	`https://app.example.com`, from anywhere	`http://<server-ip>`, at home only
Apps	Each with its own HTTPS address, for example `plex.example.com`	Server address and the app's usual port
Passkeys	Yes	No, they need HTTPS on your own domain
You need	A domain with DNS at Cloudflare (the free plan is enough) and access to your router	Nothing else

example.com stands for your own domain, <server-ip> for the address of the server at home, for example 192.168.1.200.

Prepare domain mode

Create a Cloudflare API token. Cloudflare → My Profile → API Tokens → Create Token → template Edit zone DNS → Zone Resources: Include, Specific zone, your domain → Create Token. Copy the token; the installer asks for it. Use an API token, never the Global API Key, and never paste it into chats or emails.
Add one DNS record. Cloudflare → your domain → DNS → Records:

Type Name Value Proxy

A * your public IP DNS only (grey cloud)

Leave existing records for your website or mail as they are. Your public IP: on the server, curl -4 -s https://ifconfig.me. If it changes now and then, CloudZH updates the record itself (DynDNS).
Forward a port in your router. TCP 443 to <server-ip>, for dashboard, apps and Plex. For the VPN later, also UDP 51820. Nothing else.

Type	Name	Value	Proxy
A	`*`	your public IP	DNS only (grey cloud)

More on addresses, the certificate and the hosts entry for faster access at home: Domain & HTTPS.

LAN mode

Leave the domain empty when the installer asks for it. The dashboard then opens at http://<server-ip> in your home network.

To switch to a domain later, prepare it as above and run the installer again in its folder (cd ~/cloudzh && sudo bash install.sh). It asks whether to set up again; users and apps stay.