# DorkNet Cloudflare Tunnel config — Coolify production target.
# ────────────────────────────────────────────────────────────────────
# Routes only DorkNet's known service subdomains through the tunnel
# into the server container running on Coolify. The tunnel runs as its own Coolify
# service (or as a sidecar in the same project) and reaches the
# server over the internal Docker network.
#
# Two upstream options, pick one for {{UPSTREAM}}:
#
#   a) Internal Docker DNS (preferred when cloudflared runs in the
#      same Coolify project as the server):
#          http://dorknet-server:8080
#      The server image binds Kestrel to 0.0.0.0:8080 (HTTP only —
#      this leg of traffic is already inside the project network).
#
#   b) Coolify-published HTTPS endpoint (when cloudflared runs in a
#      separate project or on a different host):
#          https://dorknet.<your-coolify-domain>
#      Requires Coolify to be issuing a real TLS cert for that
#      hostname. originRequest.noTLSVerify can stay off.
#
# Origin TLS is now off the critical path because the server speaks
# plain HTTP inside the project network. Traffic between cloudflared
# and Cloudflare's edge is still TLS-encrypted; the only unencrypted
# leg is server → cloudflared inside the same Docker network.

tunnel: {{TUNNEL_ID}}
credentials-file: {{CREDENTIALS_FILE}}

# Defaults that apply to every ingress rule unless overridden. The
# notify.* SignalR hub needs long-lived WebSockets — cloudflared's
# defaults are conservative and can tear idle connections down, which
# the 2020 watch surfaces as "check your internet" mid-session. Two
# levers matter:
#   * keepAliveTimeout — how long cloudflared keeps the origin
#     connection pooled and alive between requests; long-lived
#     WebSockets stay open well past the default 1m30s, raise it.
#   * connectTimeout — initial origin handshake; bumping it past the
#     default avoids spurious 502s when the server is warm-booting
#     after a Coolify deploy.
# These pair with the matching Program.cs SignalR + WebSocket
# KeepAliveInterval values (15s / 30s) so traffic flows continuously
# in both directions and the tunnel never marks the stream idle.
originRequest:
  connectTimeout: 30s
  tlsTimeout: 10s
  tcpKeepAlive: 30s
  keepAliveConnections: 100
  keepAliveTimeout: 10m
  noHappyEyeballs: false

# Ingress rules are evaluated top-down. Replace localhost below with
# your DORKNET_DOMAIN when installing this as a static cloudflared
# config. Do not use a wildcard hostname: only these known client-facing
# hosts should reach the gateway.
ingress:
  - hostname: localhost
    service: {{UPSTREAM}}
    originRequest:
      httpHostHeader: localhost

  - hostname: admin.localhost
    service: {{UPSTREAM}}
  - hostname: api.localhost
    service: {{UPSTREAM}}
  - hostname: accounts.localhost
    service: {{UPSTREAM}}
  - hostname: auth.localhost
    service: {{UPSTREAM}}
  - hostname: bugreporting.localhost
    service: {{UPSTREAM}}
  - hostname: cards.localhost
    service: {{UPSTREAM}}
  - hostname: cdn.localhost
    service: {{UPSTREAM}}
  - hostname: chat.localhost
    service: {{UPSTREAM}}
  - hostname: clubs.localhost
    service: {{UPSTREAM}}
  - hostname: cms.localhost
    service: {{UPSTREAM}}
  - hostname: commerce.localhost
    service: {{UPSTREAM}}
  - hostname: data.localhost
    service: {{UPSTREAM}}
  - hostname: datacollection.localhost
    service: {{UPSTREAM}}
  - hostname: discovery.localhost
    service: {{UPSTREAM}}
  - hostname: econ.localhost
    service: {{UPSTREAM}}
  - hostname: feed.localhost
    service: {{UPSTREAM}}
  - hostname: gamelogs.localhost
    service: {{UPSTREAM}}
  - hostname: geo.localhost
    service: {{UPSTREAM}}
  - hostname: img.localhost
    service: {{UPSTREAM}}
  - hostname: leaderboard.localhost
    service: {{UPSTREAM}}
  - hostname: link.localhost
    service: {{UPSTREAM}}
  - hostname: lists.localhost
    service: {{UPSTREAM}}
  - hostname: match.localhost
    service: {{UPSTREAM}}
  - hostname: moderation.localhost
    service: {{UPSTREAM}}
  - hostname: ns.localhost
    service: {{UPSTREAM}}
  - hostname: notify.localhost
    service: {{UPSTREAM}}
  - hostname: platformnotifications.localhost
    service: {{UPSTREAM}}
  - hostname: playersettings.localhost
    service: {{UPSTREAM}}
  - hostname: roomcomments.localhost
    service: {{UPSTREAM}}
  - hostname: roomieintegrations.localhost
    service: {{UPSTREAM}}
  - hostname: rooms.localhost
    service: {{UPSTREAM}}
  - hostname: storage.localhost
    service: {{UPSTREAM}}
  - hostname: strings.localhost
    service: {{UPSTREAM}}
  - hostname: strings-cdn.localhost
    service: {{UPSTREAM}}
  - hostname: studio.localhost
    service: {{UPSTREAM}}
  - hostname: thorn.localhost
    service: {{UPSTREAM}}
  - hostname: videos.localhost
    service: {{UPSTREAM}}
  - hostname: www.localhost
    service: {{UPSTREAM}}

  # Catch-all rejects anything that didn't match (defensive — the
  # tunnel only routes traffic for hostnames listed above).
  - service: http_status:404