# Go public with Cloudflare Out of the box your server is reachable on your home network. To let people join from anywhere, flip the **Public** toggle - Phlip opens a secure Cloudflare Tunnel from your phone to the internet, all inside the app. No router settings, no port forwarding, no separate software. ## How it works Your phone makes an **outbound** connection to Cloudflare's edge; friends connect to a public HTTPS address, and Cloudflare relays the traffic down the tunnel to your phone. Your home IP is never exposed and nothing is opened on your router. Cloudflare relays the connection - your group's data still lives only on your phone. ## Your own domain For a stable address, use a **named tunnel** on a domain you own: 1. Get a domain and add it to a (free) Cloudflare account. 2. In **Settings → Hosting → Cloudflare domain**, connect your domain and API token. 3. Flip **Public** on a server. Phlip publishes a subdomain (from the server name, or a custom label) and points the tunnel at that server’s local port. 4. The public join code becomes <span class="dp-serial">9F2K4X</span>`@subdomain.yourdomain.example` You can run **several Public servers at once** on one phone — each gets its own subdomain on the same shared tunnel. The costs are optional and small: this **domain** (a few pounds a year), and — only if you run *busy* public Broadcasts — an optional **Cloudflare Workers plan** ($5/month, see below). Regular hosting and joining stay free. > [!note] 📷 Photo needed > The Cloudflare domain setup screen in the app. Save as `_images/public-domain.png`. ## Public Broadcasts & the Cloudflare Workers plan **Broadcast** links — the no-sign-up event pages anyone can open and RSVP to — are served on a small **Cloudflare Worker** with a key-value store, so guests never connect to your phone directly. That keeps the load on your device tiny, but it runs inside Cloudflare's limits. **On Cloudflare's free plan** there's a daily cap on how many reads and writes that store can do (roughly **a thousand writes a day**). Every guest RSVP is a write, so a large or public-facing Broadcast could hit the cap. To stop that happening, Phlip **throttles public Broadcasts on the free plan**: - Guest **reactions are turned off** (they'd multiply the writes) — guests can still open the link and RSVP. - A small **write meter** on the host toolbar shows how close you are to the daily limit. For a normal friend group this is plenty — **free is fine**. But if you broadcast to a crowd (a gig, a club night, a fundraiser) and want **full Broadcasts with guest reactions and headroom**, upgrade to Cloudflare's **Workers Paid plan — $5/month**: 1. In Cloudflare: **Account → Compute (Workers & Pages) → upgrade** to the Paid plan. 2. In Phlip: **Settings → Hosting → Cloudflare → Workers plan**, mark it **Paid**. Phlip then lifts the throttle. This only affects **public** Broadcasts — **LAN Broadcasts** (guests on your own Wi‑Fi) hit the phone directly with no limit, and regular members joining your server don't use the store at all. ## If you suspect a compromise In **Settings → Hosting → Cloudflare**, use **Rotate tunnel token**. Phlip creates a fresh tunnel, re-points your Public hostnames, and restarts the connection. Old tunnel credentials stop working. Pair that with the [[4. Host a server on your Android phone#6. Safer host setup (especially for Public)|safer host setup]] (guest Wi‑Fi, wiped phone). ## Notes - Prefer a **guest network** and a dedicated/wiped host phone for Public — see the host guide. - Keep Phlip updated. Builds below the published `minSafe` version cannot turn Public on until you update. - Public members connect over HTTPS. Message and event content is encrypted with the group key where supported; connection metadata still passes through the relay. The [[../FAQs|FAQs]] state the current boundary. - Turning Public off for one server removes only that hostname; other Public servers keep running. --- **Next:** hand out the code - [[3. Join a server|Join a server]].