The Mac Is the House. Cloudflare Is the Front Door.
Everything George shows the world runs on Cloudflare, and nobody has clicked a dashboard to put it there
On the morning of August 26 my blog served a webshell. Someone had gotten into the WordPress install on my old host, and the page that used to show my posts showed a file browser instead. By that evening the blog was living somewhere else, with all twenty-three posts and their two hundred images, on a new domain, behind a form that checks you are human, with a subscriber list that still worked.
Nobody sat in a dashboard that day. George did the move, and he did it from a terminal.
I want to write about that, because it is the clearest example I have of something I keep noticing: an AI system does not need a cloud with a nice UI. It needs a cloud that is entirely reachable from the command line, with honest exit codes, and configuration that lives in a file it can read. Cloudflare turned out to be that, almost by accident, and by now it holds everything George shows the outside world.
The house and the door
Here is the mental model. George lives on a Mac mini in a hallway in our apartment. His memory, the vaults, the calendars, the WhatsApp session, the monitoring, all of it stays on that machine and never leaves the LAN. That is the house.
Cloudflare is the front door. Everything the world is allowed to touch goes through it, and nothing private is behind it.
What is behind that door today, all on one family domain:
- The landing page for everything we build, a static site on Pages.
- This blog. An Astro site deployed as a Worker with static assets. The Worker also owns five small API routes: subscribe, unsubscribe, the “talk to me” form, the kit waitlist, and the broadcast that emails subscribers when a post goes live.
- The household app. The evening chores checklist my husband and I actually use. Pages Functions in front of a D1 database. George writes to it through its API when one of us says “I did the kitchen” on WhatsApp.
- A status page. Five probes, sixty-second refresh, so that when something is down there is a URL to look at instead of a message to me.
- Three D1 databases. Subscribers with double opt-in, the talk-to-me requests, the kit waitlist, and the household chores. SQLite at the edge, which for a family and a newsletter is exactly the right size of database.
- Turnstile on every form. I added it the week someone signed my newsletter up to a few hundred other newsletters. Six layers of anti-bombing, and Turnstile is the one that did the most work.
- Email routing for the domain, so george at our domain lands in his inbox and a catch-all lands in mine.
- The domain itself, on Cloudflare Registrar. Eighteen DNS records, every one of them written by a script.
- The old domain, the compromised one, which now exists only as six ordered redirect rules pointing at the new site. The WordPress is gone. What is left of it is a list of rules in a zone.
What an AI needs from a vendor
When people ask me what George needs from a cloud provider, they expect me to say an API. Everyone has an API. What he needs is more specific than that, and I only understood it by watching what he reached for.
Config as a file. The blog’s entire Cloudflare shape is one file in git: the Worker name, the assets directory, the two D1 bindings, four environment variables. When George added the second database, the change was a diff I could read in a pull request. A setting that lives in a dashboard click is invisible to him and invisible to my review. A setting in a file is something he can write, I can diff, and the next AI can understand.
A CLI that tells the truth. Everything here goes through wrangler. Deploy, run SQL against D1, list what exists, add a secret. It exits non-zero when it fails and it prints JSON when asked. That sounds like a low bar. It is not. Half of the tools George touches return zero and then quietly do nothing, and I have written whole posts about the damage. A vendor whose CLI fails loudly is a vendor an autonomous system can be trusted with.
Tokens with a small blast radius. The token that renews the certificate for our wall iPad can edit DNS on exactly one zone and nothing else. The token that deploys the blog can deploy the blog. Each one lives in the Mac’s keychain under its own name, and a launchd job pulls the one it needs at runtime. If a job ever leaks its token, the damage is that one job’s scope. For a system that runs unattended and is built partly by an AI, per-capability tokens are not a nice-to-have, they are the thing that lets me sleep.
Idempotent deploys. Publishing the same post twice updates it in place. Running the same DNS script twice changes nothing. George reruns things. Watchdogs rerun things. A platform where “run it again” is safe is a platform where a retry loop is not a disaster.
A free tier that never pages anyone. The Cloudflare line on our monthly cost report is zero dollars, and it has been since the first day. I mention this not because free matters most, but because a bill that can surprise you is one more thing that needs monitoring, and we already have enough of those.
The deploy nobody clicks
Every post on this blog, including this one, ships like this. A launchd job wakes at nine in the morning. It reads the draft from my Obsidian vault, lints it for anything private, builds the Astro site, and runs a deploy. The deploy script pulls the token from the keychain, uploads whatever changed, and then, because I do not trust anything that says “success”, curls the homepage and refuses to exit zero unless it gets a 200.
Ten deploys in the last eleven days. None of them by a human. The last time I opened the Cloudflare dashboard was to create a token.
Public DNS as a private phone book
My favorite Cloudflare trick is the one that has nothing to do with the public internet.
The iPad on our kitchen wall needs HTTPS to use its microphone, and HTTPS needs a real certificate, and a real certificate needs a real domain name. So the wall’s hostname is a public record on our domain, and its value is a private address inside the apartment. Nothing outside the LAN can reach it. The certificate comes from Let’s Encrypt through a DNS challenge, using that one-zone token.
Then our router moved the Mac to a different address after a reboot, twice, and the wall went blank while every probe on the Mac stayed green. The fix is a five-minute job with no AI in it: read the Mac’s LAN address, read the DNS record through the API, and if they differ, patch the record. Public DNS became the service directory for a private network, and Cloudflare’s API was the only part of that which never broke.
The scars
Nothing is all smooth, and the point of these posts is the scars.
- Static assets are served before your Worker. For a month the blog’s root redirected to the old domain through a rule the Worker never saw, because the asset for ”/” answered first. One line in the config tells it to run the Worker first for that path. We found it the hard way.
- Multi-statement D1 batches are transactional. One bad statement and the whole migration rolls back silently. And a migration passed with a file once did nothing at all, exit zero. Now every migration is one statement per call, and every one is verified by reading the schema back.
- Turnstile checks the hostname list. My subscribe form was quietly dead for five weeks because the page’s hostname was not on the widget’s allowed list. Zero errors anywhere. That was the day I added a probe that submits the form.
- Pages projects can live in a different account than your tokens. The household app is in an older account and the Keychain tokens are in the newer one, so deploying it still needs an interactive login. It is on the list.
- We meet Cloudflare from the other side too. The supermarket George orders from sits behind Cloudflare’s bot protection, and it rejects him the moment he looks like a script. He has to be a real browser with a real profile to fill a cart. I find this fair. Cloudflare protects other people from George exactly as well as it protects George from other people.
What I would still like
Two things, and I say them as a happy customer.
A tunnel for Grafana. We got halfway through putting our monitoring behind Cloudflare Access and stopped, because the token could not create tunnels and the browser certificate flow was too much ceremony for a Tuesday night. If that had been one scoped token and one CLI command, it would be live. And web analytics on the blog, which we have simply not wired yet, so I still do not know how many of you read this.
Why this matters for anyone building a chief
If you build your own George, you will end up with a public surface. A form. A status page. A link you send to your mom. Pick the vendor for that surface by one question: can my AI operate it end to end from a terminal, with config in a file and a token that can only do the one thing?
For us the answer was Cloudflare, and the proof is that the day my blog was hacked, the move to a new home was a build, a deploy, and a curl. Nobody clicked anything.
I'm packaging the skills, configs, and gotchas from these posts into a Build Your Own Chief starter kit. Join the waitlist to get it first.
George files his own daily ops reports on X — dry, short, occasionally contrite: @GeorgeRunsHouse.