102 lines
3.1 KiB
Markdown
102 lines
3.1 KiB
Markdown
# CLOUDFLARE_NAMED_TUNNEL_SETUP
|
|
|
|
## Goal
|
|
|
|
Постоянный HTTPS для `arhipovdan.ru` / `www.arhipovdan.ru` → production `http://127.0.0.1:3100` (`owl-web-1`), без открытия 80/443 на OwlPrime.
|
|
|
|
Quick Tunnel (`*.trycloudflare.com`) **сохранять** до полного PASS постоянного домена.
|
|
|
|
## Architecture choice
|
|
|
|
```text
|
|
REG.RU = registrar only
|
|
Cloudflare = authoritative DNS + Named Tunnel + managed TLS
|
|
```
|
|
|
|
## Current blocker in this environment
|
|
|
|
```text
|
|
cloudflared tunnel list → no origin cert (cert.pem)
|
|
CLOUDFLARE_API_TOKEN → unset
|
|
```
|
|
|
|
Named Tunnel **нельзя** создать/привязать DNS из coder без `cloudflared login` или API token.
|
|
|
|
## Recommended tunnel name
|
|
|
|
```text
|
|
owlprime-sorter-production
|
|
```
|
|
|
|
## Config template (do not commit credentials)
|
|
|
|
Path suggestion (host, outside git):
|
|
|
|
```text
|
|
~/.cloudflared/config.yml
|
|
~/.cloudflared/<TUNNEL_UUID>.json # credentials — chmod 600
|
|
```
|
|
|
|
```yaml
|
|
tunnel: <TUNNEL_UUID>
|
|
credentials-file: /home/<user>/.cloudflared/<TUNNEL_UUID>.json
|
|
|
|
ingress:
|
|
- hostname: arhipovdan.ru
|
|
service: http://127.0.0.1:3100
|
|
- hostname: www.arhipovdan.ru
|
|
service: http://127.0.0.1:3100
|
|
- service: http_status:404
|
|
```
|
|
|
|
Service target assumes cloudflared on **host network namespace** with publish `127.0.0.1:3100` (current). If cloudflared runs in Docker, use `http://host.docker.internal:3100` or shared network alias `http://owl-web-1:80` — never a ephemeral container IP.
|
|
|
|
## Operator steps (when Cloudflare access available)
|
|
|
|
1. `cloudflared login` (or set API token with Tunnel + Zone DNS edit).
|
|
2. `cloudflared tunnel list` — reuse existing sorter tunnel if present.
|
|
3. Else: `cloudflared tunnel create owlprime-sorter-production`
|
|
4. Write config (template above). Validate: `cloudflared tunnel ingress validate`
|
|
5. Run connector (systemd preferred): `cloudflared tunnel run owlprime-sorter-production`
|
|
6. Add domain to Cloudflare → note **exact** assigned nameservers.
|
|
7. Import **all** DNS from `DNS_MIGRATION_INVENTORY.md` / REG.RU panel.
|
|
8. Create public hostnames / `cloudflared tunnel route dns <tunnel> arhipovdan.ru` (+ www).
|
|
9. Remove conflicting A `185.160.137.162` for apex/www in Cloudflare zone.
|
|
10. Only then change NS at REG.RU.
|
|
11. Keep Quick Tunnel until:
|
|
|
|
```bash
|
|
curl -s https://arhipovdan.ru/version.json
|
|
# expected commit from production
|
|
PLAYWRIGHT_BASE_URL=https://arhipovdan.ru EXPECTED_COMMIT=<sha> npm run test:e2e:production
|
|
```
|
|
|
|
## Coexistence with Quick Tunnel
|
|
|
|
| Process | Role |
|
|
| ------- | ---- |
|
|
| `cloudflared tunnel --url http://127.0.0.1:3100` | Temporary public URL |
|
|
| Named Tunnel connector | Permanent hostnames (after CF zone) |
|
|
|
|
They can run in parallel; different Cloudflare edge bindings.
|
|
|
|
## Secrets policy
|
|
|
|
Never commit:
|
|
|
|
* `*.json` credentials
|
|
* `cert.pem`
|
|
* API tokens
|
|
* tunnel tokens in systemd unit Environment=
|
|
|
|
## Status (2026-07-16)
|
|
|
|
```text
|
|
Named Tunnel created: NO (auth missing — no cert.pem / CLOUDFLARE_API_TOKEN)
|
|
Ingress prepared as docs: YES
|
|
Connector healthy: N/A
|
|
DNS route: N/A
|
|
NS cutover: WAITING_USER — Cloudflare nameservers not assigned yet
|
|
Quick Tunnel: KEEP RUNNING until permanent HTTPS PASS
|
|
```
|