Cloudflare stack
jalth is a composition layer — it doesn’t replace Cloudflare products, it wires them into a coherent mesh.
| jalth capability | Cloudflare product | What it does |
|---|---|---|
| Device connectivity | WARP | WireGuard VPN. Encrypts traffic, assigns CGNAT IPs. |
| Service exposure | cloudflared Tunnels | Outbound-only tunnels to Cloudflare’s edge. |
| Access control | Access | Identity-aware reverse proxy. OIDC, SAML, email OTP. |
| DNS | DNS + Gateway DNS | Public CNAMEs for services; Gateway overrides for .mesh names. |
| SSH certificates | Access for Infrastructure | Short-lived SSH certs after SSO. |
| Egress routing | Tunnel Hostname Routes | Route DNS queries through a device’s tunnel. |
| Device registry | Workers + D1 | Mesh state and the only copy of your CF API token. |
| Configuration API | Workers + tRPC | Type-safe RPC shared between CLI and Worker. |
Free tier limits
Section titled “Free tier limits”jalth is designed to work within Cloudflare’s free tier:
| Resource | Free limit | jalth usage |
|---|---|---|
| Zero Trust seats | 50 humans | Headless service-token devices don’t count |
| Tunnels | 1,000 / account | One per device (lazy on first serve) |
| Access applications | 500 | One per exposed service |
| Mesh nodes | 50 | One per WARP device |
| Workers requests | 100,000 / day | ~10–50 per device per day |
| CDN · WAF · DDoS | Included | Automatic on every jalth serve |
What jalth is not
Section titled “What jalth is not”- Not a GUI-first tool — CLI-first; desktop tray app is on the roadmap
- Not an identity provider — Delegates to your existing IdP via Cloudflare Access
- Not P2P — All traffic relays through Cloudflare’s network
- Not a subnet router — Exposes individual services, not entire network ranges