Cloudflare & Home Hosting
Host websites on your own server — even without a public IP
Amira is built Cloudflare-first. Serve the panel, webmail and any site through Cloudflare Tunnel from a machine at home or in the office, put Cloudflare Access sign-in in front of admin areas, send a site's visitors through Cloudflare's firewall, and let the panel keep your Cloudflare DNS in sync. All of it is included in the free Community edition. Agency can also give a home server real public IPs from a cheap VPS.
Cloudflare Tunnel
Publish sites from a server with no public IP and no open web ports.
Create or connect a tunnel on the Cloudflare page, then switch on "Serve through Cloudflare Tunnel" for the panel, webmail or any site. The DNS records are created for you and never overwritten without asking. A hostname that another tunnel serves (for example your old server) can be moved here after you confirm, and the old record comes back when you remove the route. Tunnel-only mode closes the public web ports once everything is routed; SSH, mail and DNS are never touched. cloudflared is installed only when you create a tunnel.
Cloudflare Tunnel
Cloudflare Protection per Site
Send a site's visitors through Cloudflare, then refuse everyone who skips it.
A card on each domain's DNS tab turns on Cloudflare's proxy for the site's web records, so Cloudflare's firewall stops attacks before they reach your server. Lockdown then makes the site answer only visitors that come through Cloudflare: anyone who uses the server's IP address directly gets 403, while Let's Encrypt renewals and Tunnel visitors still get through. Mail records are never proxied. If a record is switched to DNS-only in the Cloudflare dashboard, the panel turns lockdown off within 5 minutes and sends an alert, so a site never stays closed to everyone.
Cloudflare Protection per Site
Cloudflare Access
A Cloudflare sign-in in front of the panel, webmail or any site or path.
Allow specific emails or email domains, a one-time PIN, or your identity providers. MCP, deploy webhooks and Let's Encrypt keep working, and the panel can refuse any request that did not pass Access.
Cloudflare Access
Real Visitor Addresses
Logs, firewall and rate limits see the visitor, not Cloudflare.
Behind Cloudflare, the real client address is used in web logs, the web application firewall, fail2ban, the login rate limit, the admin IP allowlist and the audit log. The panel trusts the forwarded address only from Cloudflare's published ranges (refreshed daily) or a local tunnel, so visitors cannot spoof it.
Real Visitor Addresses
Cloudflare Zones & Token Check
See every zone your token reaches and exactly what it is allowed to do.
The Cloudflare page lists every zone your API token reaches, which panel domains sync there and how many records the panel manages. The token check shows which features the token covers (zones, DNS, Tunnel, Access), what is missing and how to fix it, with a link that opens Cloudflare's create-token page pre-filled. Parking records left by your registrar can be replaced with one tick, after a preview.
Cloudflare Zones & Token Check
Shared DNS
Share a Cloudflare zone, or part of one, with a hosting account.
The admin can share a zone from the server's Cloudflare account with a customer, limited to the names and record types you choose. Mail records are shared only when you allow them, and NS and SOA never are. The customer can then manage DNS and add sites inside that share, and nothing outside it.
Shared DNS
Public Address Behind NAT
DNS records use the router's public IP, kept current automatically.
When the server's own IPv4 is private, the panel detects its public address every 5 minutes and uses it for DNS records. When the address changes, A records and SPF entries follow it in the panel, PowerDNS and Cloudflare.
Public Address Behind NAT
Mail Gateways for Home Servers
Send and receive email through a small public VPS — no mail software on it.
Home connections usually block port 25 and have no reverse DNS. Agency connects to a cheap VPS over WireGuard: mail ports are forwarded to your server with the real client addresses kept, and outgoing mail leaves with the gateway's address and reverse DNS. Several gateways give failover.
Mail Gateways for Home Servers
Public IPs from a WireGuard Hub
Give a home server real public IPv4 and IPv6 addresses from a cheap VPS.
Rent a VPS that comes with spare public IPs. On Server → Public IPs the panel sets it up as a hub over SSH and hands single addresses to your server through WireGuard, each with the ports you choose (mail, websites, both, or custom). Only traffic from those addresses uses the tunnel. An address can join the Email IP Pool and carry all of the server's mail: MX points at its reverse DNS name and SPF stops listing the home connection, and mail apps get a valid certificate for that name. Several servers can share one hub, and the panel checks every hub each minute.
Public IPs from a WireGuard Hub
Frequently Asked Questions
Try Cloudflare & Home Hosting Today
Start free with Solo Community — 143 MCP tools and the full panel.