The shape
A cloudflared connector runs in a dedicated always-on container and holds outbound QUIC connections to Cloudflare. Public hostnames map to internal origins through the tunnel's ingress rules. Nothing listens on the WAN, and the origin addresses are never published.
Authentication sits in front as Cloudflare Access delegating to Authelia over OIDC, with OpenLDAP as the identity store and group membership driving authorisation.
Two failures worth recording
Authelia rejecting X-Forwarded-Proto: http. cloudflared speaks plain HTTP to the backend, but Authelia's OIDC implementation requires HTTPS in that header or it generates OAuth redirect URIs with the wrong scheme. The fix is a small nginx shim in front that injects the correct header before proxying.
A connector on a stopped container reading as a total outage. Most hostnames appeared to work — they returned 302s. Those 302s were Cloudflare Access login pages, served by Cloudflare itself, entirely independent of whether the origin was alive. Only the one hostname not behind Access showed the real error.
The lesson generalises past this stack: when an auth layer can answer on behalf of a dead origin, a green check on the front door tells you nothing about the building. Probe something that must reach the origin to succeed.