#cloudflare

Replace Caddy with cloudflared: expose Kubernetes without opening ports 80 and 443

Move the public entry point and identity checks to Cloudflare, then reach internal services through an outbound-only Tunnel.