cloudflare-worker-tailscale-shieldlisted

# Cloudflare Worker fronting a Tailscale Funnel service (webhook-shield pattern) First built 2026-07-18 for `n8n-webhook-shield` in the `homelab` repo: a public Worker in front of n8n's Krisp webhook, validating auth + rate-limiting at Cloudflare's edge before forwarding to n8n over its existing Tailscale Funnel. Generalizes to any "put a Worker in front of a Tailscale-exposed homelab service" project. ## The core constraint: Workers can't reach tailnet-private addresses Cloudflare Workers run on Cloudflare's edge network, not inside your tailnet. A Worker can only reach a homelab service via a URL that's **actually publicly resolvable and reachable** — i.e. the target's Tailscale **Funnel** URL, never a Serve-only (tailnet-private) one. This means a plain Worker genuinely cannot "take a service off the public internet entirely" while still being able to reach it — that requires a Cloudflare Tunnel connector running inside the homelab instead (a separate, larger project). Confirm this tradeoff with whoever's asking for the shield *before* building — the "n8n off the public internet" framing in an initial ask may not be fully achievable with a Worker alone, and that's worth surfacing rather than silently building something that doesn't match the stated goal. What a Worker-in-front **does** genuinely deliver: the origin's Funnel URL becomes double-gated (edge check + the origin's own existing auth), bad/abusive requests get rejected before ever reaching home bandwidth, and