Building a Self-Hosted Cloudflare with WireGuard and NPM

When I decided to replace Cloudflare with my own infrastructure, I needed three things: a cheap VPS, a WireGuard tunnel, and Nginx Proxy Manager. Here is how I wired it all together.

# VPS WireGuard config\n[Interface]\nAddress = 10.0.0.1/24\nListenPort = 51820\n\n[Peer]\nPublicKey = Y942RDqgZElCKqVaFQetqKNfxnlPIoDN9l/Sgd4RDlY=\nAllowedIPs = 10.0.0.2/32, 192.160.1.0/24

The tunnel connects my homelab to the public internet through a \/month VPS. Traffic hits the VPS, gets SSL terminated by NPM, then routes through WireGuard to the right internal service. No Cloudflare middleman, no shared certificates, full control.

Why not just use Cloudflare?

• Cloudflare terminates SSL — they see your traffic in plaintext
• Custom error pages require a paid plan
• Rate limiting is expensive
• I wanted to learn WireGuard internals

The result: a reverse proxy that costs less than a coffee per month and gives me complete control over every request.