How a phone ends up hosting a website
The phone dials out to Cloudflare's edge and holds the connection open. Requests arrive at the edge, travel back down that tunnel, and land on Caddy running on the handset. Nothing listens on a public port, the router was never touched, and there is no origin address to attack.
The hardware is a mid range phone from 2021. It draws about two watts. It has a battery, so it rides out a power cut better than most home servers, and the whole stack runs under a normal Android app with no root.
