The stack is deployed by Komodo onto an existing Docker host that already sits behind a shared Cloudflare Tunnel, so the app publishes a host port and the tunnel routes the public hostname to it. Secrets come from the stack env.
