Restrict gateway to configured public hosts

tools/cloudflared-config.coolify.yml.template

@@ -1,7 +1,7 @@
 # DorkNet Cloudflare Tunnel config — Coolify production target.
 # ────────────────────────────────────────────────────────────────────
-# Routes every localhost subdomain through the tunnel into the server
-# container running on Coolify. The tunnel runs as its own Coolify
+# Routes only DorkNet's known service subdomains through the tunnel
+# into the server container running on Coolify. The tunnel runs as its own Coolify
 # service (or as a sidecar in the same project) and reaches the
 # server over the internal Docker network.
 #
@@ -49,24 +49,93 @@ originRequest:
   keepAliveTimeout: 10m
   noHappyEyeballs: false
 
-# Ingress rules are evaluated top-down. The wildcard catches every
-# subdomain we don't list explicitly, so when the 2020 Rec Room client
-# (post-domain-patch) hits a niche subdomain like roomieintegrations.
-# localhost, the request still reaches the server.
+# Ingress rules are evaluated top-down. Replace localhost below with
+# your DORKNET_DOMAIN when installing this as a static cloudflared
+# config. Do not use a wildcard hostname: only these known client-facing
+# hosts should reach the gateway.
 ingress:
   - hostname: localhost
     service: {{UPSTREAM}}
     originRequest:
       httpHostHeader: localhost
 
-  - hostname: "*.localhost"
+  - hostname: admin.localhost
+    service: {{UPSTREAM}}
+  - hostname: api.localhost
+    service: {{UPSTREAM}}
+  - hostname: accounts.localhost
+    service: {{UPSTREAM}}
+  - hostname: auth.localhost
+    service: {{UPSTREAM}}
+  - hostname: bugreporting.localhost
+    service: {{UPSTREAM}}
+  - hostname: cards.localhost
+    service: {{UPSTREAM}}
+  - hostname: cdn.localhost
+    service: {{UPSTREAM}}
+  - hostname: chat.localhost
+    service: {{UPSTREAM}}
+  - hostname: clubs.localhost
+    service: {{UPSTREAM}}
+  - hostname: cms.localhost
+    service: {{UPSTREAM}}
+  - hostname: commerce.localhost
+    service: {{UPSTREAM}}
+  - hostname: data.localhost
+    service: {{UPSTREAM}}
+  - hostname: datacollection.localhost
+    service: {{UPSTREAM}}
+  - hostname: discovery.localhost
+    service: {{UPSTREAM}}
+  - hostname: econ.localhost
+    service: {{UPSTREAM}}
+  - hostname: feed.localhost
+    service: {{UPSTREAM}}
+  - hostname: gamelogs.localhost
+    service: {{UPSTREAM}}
+  - hostname: geo.localhost
+    service: {{UPSTREAM}}
+  - hostname: img.localhost
+    service: {{UPSTREAM}}
+  - hostname: leaderboard.localhost
+    service: {{UPSTREAM}}
+  - hostname: link.localhost
+    service: {{UPSTREAM}}
+  - hostname: lists.localhost
+    service: {{UPSTREAM}}
+  - hostname: match.localhost
+    service: {{UPSTREAM}}
+  - hostname: moderation.localhost
+    service: {{UPSTREAM}}
+  - hostname: ns.localhost
+    service: {{UPSTREAM}}
+  - hostname: notify.localhost
+    service: {{UPSTREAM}}
+  - hostname: platformnotifications.localhost
+    service: {{UPSTREAM}}
+  - hostname: playersettings.localhost
+    service: {{UPSTREAM}}
+  - hostname: roomcomments.localhost
+    service: {{UPSTREAM}}
+  - hostname: roomieintegrations.localhost
+    service: {{UPSTREAM}}
+  - hostname: rooms.localhost
+    service: {{UPSTREAM}}
+  - hostname: storage.localhost
+    service: {{UPSTREAM}}
+  - hostname: strings.localhost
+    service: {{UPSTREAM}}
+  - hostname: strings-cdn.localhost
+    service: {{UPSTREAM}}
+  - hostname: studio.localhost
+    service: {{UPSTREAM}}
+  - hostname: thorn.localhost
+    service: {{UPSTREAM}}
+  - hostname: videos.localhost
+    service: {{UPSTREAM}}
+  - hostname: www.localhost
     service: {{UPSTREAM}}
-    # cloudflared forwards the original Host header by default, which
-    # is what the server's [Host("api.localhost")] etc. attributes match
-    # against. No explicit httpHostHeader here so wildcards stay
-    # transparent.
 
   # Catch-all rejects anything that didn't match (defensive — the
-  # tunnel only routes traffic for hostnames we've added DNS records
-  # for, so this is rarely reached).
+  # tunnel only routes traffic for hostnames listed above).
   - service: http_status:404

tools/cloudflared-config.yml.template

@@ -1,7 +1,7 @@
 # DorkNet Cloudflare Tunnel config
 # ────────────────────────────────────────────────────────────────────
-# Routes every localhost subdomain through the tunnel into the local
-# server (HTTPS on port 443). Generated by tools/setup-cloudflared.ps1
+# Routes only DorkNet's known localhost service subdomains through the
+# tunnel into the local server (HTTPS on port 443). Generated by tools/setup-cloudflared.ps1
 # — copy to %USERPROFILE%\.cloudflared\config.yml and replace the
 # {{TUNNEL_ID}} / {{CREDENTIALS_FILE}} placeholders.
 #
@@ -14,27 +14,96 @@
 tunnel: {{TUNNEL_ID}}
 credentials-file: {{CREDENTIALS_FILE}}
 
-# Ingress rules are evaluated top-down. The wildcard catches every
-# subdomain we don't list explicitly, so when the 2020 Rec Room client
-# (post-domain-patch) hits a niche subdomain like roomieintegrations.
-# localhost, the request still reaches the server.
+originRequest:
+  noTLSVerify: true
+
+# Ingress rules are evaluated top-down. Keep this list aligned with
+# DorkNetRouteOwnership.PublicSubdomains and ConfigService.ServiceSubdomains.
+# Do not use *.localhost here: only the subdomains the client actually
+# needs should reach the gateway/server.
 ingress:
   - hostname: localhost
     service: https://localhost:443
     originRequest:
-      noTLSVerify: true
       httpHostHeader: localhost
 
-  - hostname: "*.localhost"
+  - hostname: admin.localhost
+    service: https://localhost:443
+  - hostname: api.localhost
+    service: https://localhost:443
+  - hostname: accounts.localhost
+    service: https://localhost:443
+  - hostname: auth.localhost
+    service: https://localhost:443
+  - hostname: bugreporting.localhost
+    service: https://localhost:443
+  - hostname: cards.localhost
+    service: https://localhost:443
+  - hostname: cdn.localhost
+    service: https://localhost:443
+  - hostname: chat.localhost
+    service: https://localhost:443
+  - hostname: clubs.localhost
+    service: https://localhost:443
+  - hostname: cms.localhost
+    service: https://localhost:443
+  - hostname: commerce.localhost
+    service: https://localhost:443
+  - hostname: data.localhost
+    service: https://localhost:443
+  - hostname: datacollection.localhost
+    service: https://localhost:443
+  - hostname: discovery.localhost
+    service: https://localhost:443
+  - hostname: econ.localhost
+    service: https://localhost:443
+  - hostname: feed.localhost
+    service: https://localhost:443
+  - hostname: gamelogs.localhost
+    service: https://localhost:443
+  - hostname: geo.localhost
+    service: https://localhost:443
+  - hostname: img.localhost
+    service: https://localhost:443
+  - hostname: leaderboard.localhost
+    service: https://localhost:443
+  - hostname: link.localhost
+    service: https://localhost:443
+  - hostname: lists.localhost
+    service: https://localhost:443
+  - hostname: match.localhost
+    service: https://localhost:443
+  - hostname: moderation.localhost
+    service: https://localhost:443
+  - hostname: ns.localhost
+    service: https://localhost:443
+  - hostname: notify.localhost
+    service: https://localhost:443
+  - hostname: platformnotifications.localhost
+    service: https://localhost:443
+  - hostname: playersettings.localhost
+    service: https://localhost:443
+  - hostname: roomcomments.localhost
+    service: https://localhost:443
+  - hostname: roomieintegrations.localhost
+    service: https://localhost:443
+  - hostname: rooms.localhost
+    service: https://localhost:443
+  - hostname: storage.localhost
+    service: https://localhost:443
+  - hostname: strings.localhost
+    service: https://localhost:443
+  - hostname: strings-cdn.localhost
+    service: https://localhost:443
+  - hostname: studio.localhost
+    service: https://localhost:443
+  - hostname: thorn.localhost
+    service: https://localhost:443
+  - hostname: videos.localhost
+    service: https://localhost:443
+  - hostname: www.localhost
     service: https://localhost:443
-    originRequest:
-      noTLSVerify: true
-      # Forward the original Host header verbatim so the server's
-      # [Host("api.localhost")] etc. attributes match correctly.
-      # (cloudflared does this by default; setting it explicitly so
-      # config.yml is self-documenting.)
 
   # Catch-all rejects anything that didn't match (defensive — the
-  # tunnel only routes traffic for hostnames we've added DNS records
-  # for, so this is rarely reached).
+  # tunnel only routes traffic for hostnames listed above).
   - service: http_status:404

tools/setup-cloudflared.ps1

@@ -78,19 +78,15 @@ $Template = Join-Path $PSScriptRoot 'cloudflared-config.yml.template'
 $CfDir    = Join-Path $env:USERPROFILE '.cloudflared'
 $ConfigPath = Join-Path $CfDir 'config.yml'
 
-# Subdomains we want routed through the tunnel. The wildcard route in
-# config.yml catches everything; this list drives the per-subdomain
-# DNS CNAMEs Cloudflare needs (no automatic wildcard CNAME via the
-# CLI — each one is created explicitly via `cloudflared tunnel route
-# dns`).
+# Subdomains routed through the tunnel. Keep this list aligned with
+# DorkNetRouteOwnership.PublicSubdomains and the cloudflared config
+# template. We intentionally create explicit DNS routes instead of a
+# wildcard so unrelated subdomains do not reach the gateway.
 $Subdomains = @(
     '@',                        # apex (localhost itself)
     'admin', 'api', 'accounts', 'auth', 'cdn', 'chat', 'commerce',
     'discovery', 'econ', 'feed', 'geo', 'img', 'match', 'notify',
     'ns', 'playersettings', 'rooms', 'storage', 'strings', 'strings-cdn',
-    # Long-tail subdomains DorkNet's stub controllers ack — adding
-    # CNAMEs for these means the patched client never hits a NXDOMAIN
-    # for any of the URLs it might probe.
     'bugreporting', 'cards', 'clubs', 'cms', 'data', 'datacollection',
     'gamelogs', 'leaderboard', 'link', 'lists', 'moderation',
     'platformnotifications', 'roomcomments', 'roomieintegrations',