# DorkNet Cloudflare Tunnel config
# ────────────────────────────────────────────────────────────────────
# Routes only DorkNet's known localhost service subdomains through the
# tunnel into the local server (HTTPS on port 443). Generated by tools/setup-cloudflared.ps1
# — copy to %USERPROFILE%\.cloudflared\config.yml and replace the
# {{TUNNEL_ID}} / {{CREDENTIALS_FILE}} placeholders.
#
# Origin TLS verify is OFF because the local server's wildcard cert is
# from mkcert (a private CA trusted only on this machine). cloudflared
# would reject it as untrusted otherwise. Traffic between cloudflared
# and Cloudflare's edge is still TLS-encrypted; this only relaxes the
# leg from cloudflared → localhost.

tunnel: {{TUNNEL_ID}}
credentials-file: {{CREDENTIALS_FILE}}

originRequest:
  noTLSVerify: true

# Ingress rules are evaluated top-down. Keep this list aligned with
# DorkNetRouteOwnership.PublicSubdomains and ConfigService.ServiceSubdomains.
# Do not use *.localhost here: only the subdomains the client actually
# needs should reach the gateway/server.
ingress:
  - hostname: localhost
    service: https://localhost:443
    originRequest:
      httpHostHeader: localhost

  - hostname: admin.localhost
    service: https://localhost:443
  - hostname: api.localhost
    service: https://localhost:443
  - hostname: accounts.localhost
    service: https://localhost:443
  - hostname: auth.localhost
    service: https://localhost:443
  - hostname: bugreporting.localhost
    service: https://localhost:443
  - hostname: cards.localhost
    service: https://localhost:443
  - hostname: cdn.localhost
    service: https://localhost:443
  - hostname: chat.localhost
    service: https://localhost:443
  - hostname: clubs.localhost
    service: https://localhost:443
  - hostname: cms.localhost
    service: https://localhost:443
  - hostname: commerce.localhost
    service: https://localhost:443
  - hostname: data.localhost
    service: https://localhost:443
  - hostname: datacollection.localhost
    service: https://localhost:443
  - hostname: discovery.localhost
    service: https://localhost:443
  - hostname: econ.localhost
    service: https://localhost:443
  - hostname: feed.localhost
    service: https://localhost:443
  - hostname: gamelogs.localhost
    service: https://localhost:443
  - hostname: geo.localhost
    service: https://localhost:443
  - hostname: img.localhost
    service: https://localhost:443
  - hostname: leaderboard.localhost
    service: https://localhost:443
  - hostname: link.localhost
    service: https://localhost:443
  - hostname: lists.localhost
    service: https://localhost:443
  - hostname: match.localhost
    service: https://localhost:443
  - hostname: moderation.localhost
    service: https://localhost:443
  - hostname: ns.localhost
    service: https://localhost:443
  - hostname: notify.localhost
    service: https://localhost:443
  - hostname: platformnotifications.localhost
    service: https://localhost:443
  - hostname: playersettings.localhost
    service: https://localhost:443
  - hostname: roomcomments.localhost
    service: https://localhost:443
  - hostname: roomieintegrations.localhost
    service: https://localhost:443
  - hostname: rooms.localhost
    service: https://localhost:443
  - hostname: storage.localhost
    service: https://localhost:443
  - hostname: strings.localhost
    service: https://localhost:443
  - hostname: strings-cdn.localhost
    service: https://localhost:443
  - hostname: studio.localhost
    service: https://localhost:443
  - hostname: thorn.localhost
    service: https://localhost:443
  - hostname: videos.localhost
    service: https://localhost:443
  - hostname: www.localhost
    service: https://localhost:443

  # Catch-all rejects anything that didn't match (defensive — the
  # tunnel only routes traffic for hostnames listed above).
  - service: http_status:404