KISS the DNS

(let's see how linkedinified a llm generated post critisising said llm feels and looks :D) Two hours. That's how long it took me and an LLM to arrive back at the simplest possible answer: point an A record at your server and let Caddy handle the rest. This is the story of those two hours.

The problem

I run several sites on a single VPS, all routed through a Caddy reverse proxy. The goal was simple: use wildcard subdomains so that adding a new site means editing one config file and nothing else — no manually adding DNS records for every new subdomain.

My domains are on Cloudflare's free plan. I'd heard about Cloudflare Tunnel as a way to handle wildcard proxying without needing a paid plan. I asked an LLM to help me set it up. That was my first mistake.

Step one: the tunnel

"Add a cloudflared container to your docker-compose," said the LLM. "Set TUNNEL_TOKEN. Route traffic from Cloudflare's edge to your Caddy." Simple enough. I spent 20 minutes setting it up, creating the token in Zero Trust, writing the config.

LLM step count: 1. This one actually worked. cloudflared connected fine. The tunnel was healthy. Then I visited my site and got a 521.

Step two: the 521

Error 521 means the origin is unreachable. "What do the cloudflared logs say?" asked the LLM. I pasted the output. "Ah — Caddy isn't listening on port 80. You need to add auto_https off and prefix all your site addresses with http://."

Twenty more minutes. Caddyfile rewritten. Caddy restarted. Site up. Progress! Then I tried another subdomain. DNS_PROBE_POSSIBLE.

Step three: the wildcard NXDOMAIN

The tunnel dashboard had warned me when I added *.qlay.net: "This wildcard, so no records will be created." I'd assumed the LLM would have told me about this upfront. It hadn't. Now we debugged it: "What does dig games.qlay.net return?"

; ANSWER: 0, AUTHORITY: 1
;; status: NXDOMAIN

Cloudflare was returning NXDOMAIN for my own subdomain. On the free plan, proxied wildcard CNAME records are silently ignored. The orange cloud on * does nothing. You get no error, just a non-existent domain.

Time elapsed: ~1 hour. We had a working tunnel to a Caddy that nobody could reach.

Step four: "just switch to grey cloud"

"Switch the * CNAME from proxied to DNS only," said the LLM. "The tunnel IS the proxy — you don't need the orange cloud on top of it." This was technically correct and I appreciate the clarification, but at this point I had lost faith. I'd been told at the start that this setup would work on the free plan. It did — sort of — but only after finding every landmine first.

Then the my other sites broke because I'd put them in their own compose file with their own Caddy, and two Caddys can't share port 80. Then both compose files reported orphaned containers because they shared a project name. Each fix revealed another problem.

Time elapsed: ~2 hours. I reverted everything.

The actual answer

The setup I ended up with — and should have started with — is this:

VPS DNS (or grey-cloud Cloudflare A record): * → your-server-ip
Caddy handles TLS automatically via Let's Encrypt
Adding a new site: edit Caddyfile, reload Caddy
No tunnel. No cloudflared. No extra container. No token management.

Keep It Simple, Stupid. An A record and Caddy is two moving parts. A Cloudflare Tunnel, a separate cloudflared container, a token stored in an .env file, and a Zero Trust dashboard to configure is eight. Both achieve the same end result for a personal VPS.

On LLM-assisted debugging

The LLM was helpful at every individual step. It correctly diagnosed each error. But it never stepped back and said "actually, this whole approach is more complex than it needs to be — here's the simpler path." It just kept going deeper. "Configure this. What do you see? Try this. What does the log say?"

The lesson I'm taking: use LLMs to execute a plan you've already validated, not to discover the plan. For architecture decisions — especially infrastructure — do the thinking yourself first, then ask for help with the implementation.

I'm moving my domains to the VPS DNS servers when I have time. No Cloudflare, no tunnel, no orange cloud. Just an A record and Caddy doing what Caddy does best.