Here is the full rewritten post with all fixes applied and full structure preserved:
This is the setup guide I wish had existed when I started.
Disclaimer: This article documents a personal technical experiment on my own infrastructure. The configurations, rules, and steps described reflect what worked in my specific environment and should not be treated as security advice, professional recommendations, or guaranteed protection against any threat. Every environment is different. Always validate independently, test in a non-production setting first, and consult qualified security professionals before applying any security-related configuration to production systems. NosisTech LLC accepts no liability for outcomes resulting from use of this content.
By the end of this post, I will have walked through how I built a Windows machine running AI models locally, a browser interface to talk to them, and a secure public URL that works from anywhere in the world, without opening a single firewall port or exposing my home IP address. In my setup, everything restarts automatically when the machine reboots. Your environment and results may differ.
I will explain every concept before I use it. If you already know what a Windows service is, some sections will be review. If you do not, those sections will save you the hours I spent learning them the hard way.
What I Built
Three components work together to create my AI lab.
Ollama is the AI model engine. It runs in the background and responds to requests from other software or from me directly through a browser. It is the core of the operation.
Open WebUI is a browser-based chat interface, like ChatGPT but running entirely on my own hardware. I access it by typing a URL in any browser, from anywhere.
Cloudflare Tunnel is the secure connection between my machine and the internet. It creates an outbound-only encrypted link to Cloudflare’s global network, my machine reaches out to Cloudflare, Cloudflare does not reach in to me. No firewall ports to open, no router settings to change, no home IP address exposed.
When all three were configured correctly and set to auto-start as Windows services, my lab runs permanently in the background. I can open a browser from a hotel lobby, an airport, or another country, type my private URL, and I am talking to my own AI running on my own hardware. Your configuration and environment will affect your results.
Before You Start: Understanding Windows Services
A Windows service is a program that runs in the background without any visible window. It starts when the computer boots, continues running whether or not anyone is logged in, and restarts automatically if it crashes.
This is the architectural property that made always-on remote access possible in my setup. A regular program with a visible window stops when the window closes or the user logs out. A service never stops unless you explicitly tell it to.
I configured all three components, Ollama, Open WebUI, and Cloudflare, as Windows services using a free tool called NSSM. Once that was done, the lab became self-managing.
Step 1: Install Ollama
Go to ollama.com and download the Windows installer. Run it. Ollama installs itself and registers a startup task in Windows Task Scheduler automatically, it is designed to work this way out of the box.
To verify Ollama is running, open PowerShell and run:
Invoke-RestMethod http://localhost:11434/api/tagsYou should see a response listing your installed models. If Ollama is not yet running, launch it once from the Start menu, after that first launch, it auto-starts on every reboot.
To download a model, run:
ollama pull qwen3:30b-a3bReplace the model name with whichever model you want. Ollama downloads and stores it automatically.
Step 2: Install Open WebUI
Open WebUI requires Python 3.12. If you do not have it, download it from python.org and install it, make sure to check “Add Python to PATH” during installation.
Once Python is installed, open PowerShell and run:
pip install open-webuiThis downloads Open WebUI and all its dependencies. It may take a few minutes. When it finishes, test it manually:
open-webui serveOpen a browser and go to http://localhost:8080. You should see the Open WebUI interface. Create your admin account on first launch, then press Ctrl+C to stop it, we will set it up as a proper auto-starting service in Step 4.
Step 3: Install NSSM
NSSM, Non-Sucking Service Manager, is a free tool that wraps any program and runs it as a proper Windows service, with automatic restart on failure and correct boot-time startup. I used it for both Open WebUI and Cloudflare Tunnel.
Install it with:
winget install nssmAfter installation, close PowerShell and open a new Admin PowerShell window, the PATH needs to refresh before NSSM commands will work.
Step 4: Register Open WebUI as a Windows Service
First, find the exact path where Open WebUI was installed:
where.exe open-webuiYou will see a path like C:\Users\YourName\AppData\Local\Programs\Python\Python312\Scripts\open-webui.exe. Use that exact path in the commands below, replacing YourName with your actual Windows username.
Run these commands in Admin PowerShell:
nssm install OpenWebUI "C:\Users\YourName\AppData\Local\Programs\Python\Python312\Scripts\open-webui.exe" serve
nssm set OpenWebUI AppDirectory "C:\Users\YourName"
nssm set OpenWebUI AppRestartDelay 5000
Start-Service OpenWebUIVerify it started:
Get-Service OpenWebUIYou should see Status: Running. In my setup, Open WebUI starts automatically on every reboot with no window to open and no command to run.
Step 5: Set Up the Cloudflare Tunnel
This step has several parts. Work through them in order.
5a. Create a Cloudflare account and add your domain
Go to cloudflare.com, create a free account, and add your domain. Cloudflare will become the DNS provider for that domain, this is what allows you to create secure subdomains pointing to your home machine.
5b. Install cloudflared
Download the cloudflared installer for Windows from the Cloudflare developers documentation page. Run the installer.
5c. Authenticate
In Admin PowerShell, run:
cloudflared tunnel loginA browser window opens. Log in to your Cloudflare account and authorize cloudflared. A certificate file is saved to C:\Users\YourName.cloudflared\cert.pem.
5d. Create the tunnel
cloudflared tunnel create predator-aiThis creates a tunnel and saves a credentials JSON file in your .cloudflared folder. Note the tunnel ID in the output, a long string of letters and numbers, you will need it in the next step.
5e. Create the config file
Create a file at C:\Users\YourName.cloudflared\config.yml with this content, replacing the placeholders with your actual values:
tunnel: YOUR-TUNNEL-ID
credentials-file: C:\Users\YourName\.cloudflared\YOUR-TUNNEL-ID.json
ingress:
- hostname: ai.yourdomain.com
service: http://localhost:11434
- hostname: chat.yourdomain.com
service: http://localhost:8080
- service: http_status:404The ingress section tells Cloudflare what to do with requests to each subdomain. In my setup, requests to ai.yourdomain.com get forwarded to Ollama on port 11434. Requests to chat.yourdomain.com get forwarded to Open WebUI on port 8080. Anything else returns a 404.
5f. Add DNS records
cloudflared tunnel route dns predator-ai ai.yourdomain.com
cloudflared tunnel route dns predator-ai chat.yourdomain.comThis creates CNAME records in your Cloudflare DNS pointing both subdomains to your tunnel automatically.
5g. Test the tunnel manually
cloudflared tunnel run predator-aiYou should see lines saying “Registered tunnel connection” with location codes like mia04 or tgu01. Those are Cloudflare edge nodes confirming the connection is live. If you see them, the tunnel is working in this configuration. Press Ctrl+C to stop it.
Step 6: Register Cloudflare Tunnel as a Windows Service
This is where most guides stop and where most people run into problems on Windows. Cloudflared’s own built-in service installer does not reliably load the config.yml file in my experience, which means the tunnel starts but never connects. I used NSSM instead for full control.
First confirm the cloudflared path:
where.exe cloudflaredIt is typically C:\Program Files (x86)\cloudflared\cloudflared.exe.
Run these commands in Admin PowerShell, replacing the paths with yours:
nssm install cloudflared "C:\Program Files (x86)\cloudflared\cloudflared.exe" "tunnel -config \"C:\Users\YourName\.cloudflared\config.yml\" run predator-ai"
nssm set cloudflared AppDirectory "C:\Users\YourName\.cloudflared"
nssm set cloudflared AppRestartDelay 5000
nssm set cloudflared DisplayName "Cloudflared Tunnel"
Start-Service cloudflared
Start-Sleep -Seconds 8
cloudflared tunnel listIn the output, look at the CONNECTIONS column next to your tunnel name. You should see something like 2xmia04, 1xtgu01, those are active connections to Cloudflare’s edge. If you see them, the service is working correctly in this configuration.
Step 7: Verify Everything End to End
Open a browser, ideally on a different network, like your phone’s mobile data, to confirm the tunnel is truly public:
Navigate to ai.yourdomain.com/api/tags. In my setup, you should see a JSON response listing your Ollama models.
Navigate to chat.yourdomain.com. You should see the Open WebUI chat interface.
If both load correctly, the lab is fully operational in this configuration.
Step 8: The Reboot Test
The reboot test is the real test. Restart your machine completely. After it comes back up, open Admin PowerShell and run:
Get-Service cloudflared, OpenWebUI
cloudflared tunnel list
netstat -ano | findstr "11434\|8080"In my setup, I look for: cloudflared showing Status Running with active connections, OpenWebUI showing Status Running, and both ports 11434 and 8080 listed as LISTENING.
If all three checks pass in your environment, the lab is self-managing.
Troubleshooting: The Problems I Actually Hit
Error 1033 – Cloudflare cannot resolve the tunnel
This means cloudflared is not running, or is running but not connected. Run cloudflared tunnel list and check the CONNECTIONS column. If it is empty, the service started but did not load your config.yml, this was the most common Windows-specific failure I encountered. The fix that worked for me is Step 6 exactly as written: use NSSM with an explicit config path rather than cloudflared’s own service installer.
Error 524 – Gateway timeout
Cloudflare reached the tunnel but the local service did not respond in time. The tunnel is working, the problem is behind it. Check whether Open WebUI or Ollama is running and whether the correct port is listening.
Get-service OpenWebUI
netstat -ano | findstr "8080"Open WebUI shows “Backend Required”
Open WebUI loaded its frontend but cannot reach its own backend. In my experience this usually means the service is still initializing, Open WebUI takes 30 to 60 seconds to fully start after the service launches. Wait and refresh. If it persists, check Get-Service OpenWebUI and netstat -ano | findstr “8080”.
Service stuck on “Waiting to stop”
The service process is hanging. Force kill it and reinstall:
taskkill /F /IM cloudflared.exeThen repeat Step 6 from the NSSM install command.
What I Now Have
A home AI lab that runs large language models locally on my own hardware, is accessible from any browser anywhere in the world, requires no open firewall ports and exposes no home IP address, restarts automatically after any reboot or crash, and costs nothing beyond the electricity to run the machine.
The compute is mine. The data stays on my hardware. The only thing Cloudflare sees is encrypted traffic passing through its network.
This is my personal AI cloud. And unlike a rented cloud, in my setup nobody can take it offline, raise the price, or read my prompts, though your specific security posture depends on your own configuration and threat model.