# DorkNet Cloudflare Tunnel config
# ────────────────────────────────────────────────────────────────────
# Routes every localhost subdomain through the tunnel into the local
# server (HTTPS on port 443). Generated by tools/setup-cloudflared.ps1
# — copy to %USERPROFILE%\.cloudflared\config.yml and replace the
# {{TUNNEL_ID}} / {{CREDENTIALS_FILE}} placeholders.
#
# Origin TLS verify is OFF because the local server's wildcard cert is
# from mkcert (a private CA trusted only on this machine). cloudflared
# would reject it as untrusted otherwise. Traffic between cloudflared
# and Cloudflare's edge is still TLS-encrypted; this only relaxes the
# leg from cloudflared → localhost.

tunnel: {{TUNNEL_ID}}
credentials-file: {{CREDENTIALS_FILE}}

# Ingress rules are evaluated top-down. The wildcard catches every
# subdomain we don't list explicitly, so when the 2020 Rec Room client
# (post-domain-patch) hits a niche subdomain like roomieintegrations.
# localhost, the request still reaches the server.
ingress:
  - hostname: localhost
    service: https://localhost:443
    originRequest:
      noTLSVerify: true
      httpHostHeader: localhost

  - hostname: "*.localhost"
    service: https://localhost:443
    originRequest:
      noTLSVerify: true
      # Forward the original Host header verbatim so the server's
      # [Host("api.localhost")] etc. attributes match correctly.
      # (cloudflared does this by default; setting it explicitly so
      # config.yml is self-documenting.)

  # Catch-all rejects anything that didn't match (defensive — the
  # tunnel only routes traffic for hostnames we've added DNS records
  # for, so this is rarely reached).
  - service: http_status:404