Securely hosted on a GCP VM with Docker and exposed through a Cloudflare Tunnel.
A visitor reaches the domain through Cloudflare first. Inside the GCP VM, the cloudflared container keeps an outbound tunnel open to Cloudflare, so Cloudflare can forward matching requests through that tunnel to the Docker web container. The Python app only listens inside the VM/Docker environment on port 8000; the public entrypoint is Cloudflare, not an exposed app port.