When a Cloudflare Tunnel fronts NGINX, decide which layer owns TLS for the public hostname and keep that story consistent: either the edge terminates for visitors while the connector dials NGINX over a private path, or NGINX still presents certificates on a local listener the connector alone can reach. Forward Host and X-Forwarded-Proto (and the edge forwarded client headers if you need them) so apps mint correct absolute URLs; do not leave NGINX advertising an internal compose hostname in Location or asset links after DNS cutover. Keep admin UIs off the same public Host the tunnel publishes for apps.

Ops prove-out after DNS and tunnel ingress change: confirm the connector shows healthy, reach the upstream from the connector network by the NGINX listen name, then hit the public Host twice and compare status plus certificate SAN against the name clients dial. Mixed content or redirect loops after migration usually mean the app or NGINX still assumes cleartext on the loopback port the connector dials — fix forwarded proto and host before chasing DNS TTLs. If only one path returns 502, check the tunnel ingress path and service mapping and that NGINX upstream resolution still reaches the app on the shared private network.