vuzon is a lightweight, self-hosted web panel for Cloudflare Email Routing: your domain's aliases, routing rules and destination addresses, in an interface built for everyday use. It ships as a single Docker container for your homelab or private network, and it always works against your Cloudflare account with your API token.

The problem

Email Routing is one of the best free pieces in Cloudflare's catalogue, but it is administered from a dashboard designed to operate infrastructure — not to create an alias in ten seconds from a phone. With that much friction, "a different address for every service" stays a nice idea.

vuzon collapses the flow into one screen: create netflix@yourdomain.com, see at a glance which ones are still active, and pause or delete the one that starts getting spam.

What it does

Aliases

  • Create, pause and delete aliases on your domain. Pausing keeps the rule but stops delivery.
  • Change an alias's destination without deleting and recreating it.
  • Choose what happens to the mail: forward it to a verified address, or discard it — handy to make an address look valid while receiving nothing.
  • Rename rules and see every rule in the zone, including the ones vuzon did not create: an Email Worker route shows its script, a fan-out shows all its addresses. Editing one of those replaces its action, so the panel asks first.
  • Random alias generator, 8 characters from crypto.getRandomValues (never Math.random — a guessable alias defeats the point).
  • One-click copy of the address you are about to create, and search to filter the list as it grows.

Destination addresses

  • Add and remove destinations, with verified / pending status always visible.
  • Only verified destinations can be picked for an alias, and the server enforces it — not just the UI.

Catch-all

  • You can pause it or change what it does: forward the leftovers to a verified address, or discard them.
  • What you cannot do is break it. The API always writes the "match everything" matcher and offers no delete, so the fallback rule cannot quietly stop catching mail.

Interface and operations

  • English and Spanish, switched from the header; your choice is remembered in the browser. Error messages are localised too: the API answers with a machine-readable code and the panel writes the sentence in your language.
  • A single Docker image, multi-arch amd64 / arm64, published to GHCR on every release.
  • No database. All that lives in the data volume is three small files: your panel credentials (hashed), the cookie signing key, and the session revocation mark.
  • Zone and account autodetection from DOMAIN, so there are usually only two variables to set.
  • Refuses to start on an obviously unsafe config (a template CF_API_TOKEN, an unwritable data directory) instead of coming up in a broken state.

Security and scope

vuzon is meant for personal use on a homelab or private network — not as a multi-tenant deployment or a public SaaS. It has no backend of its own, no telemetry and no third-party services: everything happens between your browser, your server and the Cloudflare API.

  • Panel credentials are chosen in the browser the first time you open it and stored as a scrypt hash in the data volume. There is no AUTH_PASS variable, and the password never exists in plain text anywhere.
  • Finish that setup right away: until you do, the panel has no owner and anyone who can reach it could claim it (the same trust-on-first-use model as Uptime Kuma or Nextcloud). The server repeats the warning in its log on every boot while it is unconfigured.
  • Back up the data volume and treat it as secret: losing it means losing the password and returning to the setup wizard.
  • Behind a reverse proxy, set TRUST_PROXY so the login rate limit sees the real client IP, and COOKIE_SECURE=1 if you terminate TLS. Both are off by default so a plain-HTTP homelab works untouched.

Stack

React and Vite on the frontend; Node.js with Express and Zod validation on the backend; Docker for packaging; the Cloudflare API as the only external dependency. Apache-2.0, image ghcr.io/kn990x/vuzon.

Getting started

mkdir vuzon && cd vuzon
curl -fsSL -O https://raw.githubusercontent.com/KN990x/vuzon/main/docker-compose.yml \
  -O https://raw.githubusercontent.com/KN990x/vuzon/main/.env.example
cp .env.example .env

# Fill in DOMAIN and CF_API_TOKEN
docker compose pull && docker compose up -d

Open http://localhost:8001 (or your server's IP) and pick a username and password in the wizard. The .env ships empty on purpose: vuzon will not start until DOMAIN and CF_API_TOKEN are set, and nothing else is required.

The API token needs three permissions: Account → Email Routing Addresses → Edit, Zone → Email Routing Rules → Edit, and Zone → Zone → Read (that last one only to resolve the zone and account from DOMAIN). Use an API token rather than the Global API Key, and scope it to the zone you plan to manage.

Full documentation — token permissions, optional variables, reverse proxies and the 1.x upgrade notes — lives at vuzon.cc and in the KN990x/vuzon repository.