HAOS HTTPS via Cloudflare Tunnel

Give a HAOS box a public https://ha.<domain> that works from anywhere, without opening router ports or installing anything on client devices. Battle-tested 2026-07-10 on a Raspberry Pi 4 (HAOS 18.1, Core 2026.6.4) with the brenner-tobias/cloudflared add-on v7.0.9; §4's ≥ 2026.8 UI steps follow the official http integration page. Every pitfall below was hit for real; ⚠️ marks them.

0. Why this route (and what was rejected)

Tunnel = the RPi opens an outbound long-lived connection to Cloudflare; DNS is a CNAME to cfargotunnel.com, never your home IP. No inbound port, dynamic IP is a non-event, TLS terminates at Cloudflare against a tunnel token.