mirror of
https://github.com/DorkSquadRR/DorkNet.git
synced 2026-10-26 07:28:45 -07:00
Alexa
142 lines
4.6 KiB
Markdown
142 lines
4.6 KiB
Markdown
# Cloudflare Tunnel
|
|
|
|
Cloudflare Tunnel is used in two DorkNet workflows:
|
|
|
|
- Local standalone testing, where cloudflared forwards `*.localhost`
|
|
traffic to a locally running `DorkNet.Server`.
|
|
- Dokploy production microservices, where the compose sidecar forwards
|
|
the apex and wildcard hostnames to `http://gateway:8080`.
|
|
|
|
Both avoid opening ports directly on the host and let Cloudflare serve a
|
|
public TLS certificate at the edge.
|
|
|
|
## Local Standalone Tunnel
|
|
|
|
Use this when you are running the standalone server locally and want
|
|
friends to reach it through Cloudflare.
|
|
|
|
- You want a friend to play the patched 2020 Rec Room client against
|
|
your server, but they're not on your LAN and don't want to install
|
|
your local CA.
|
|
- You want `https://admin.localhost` / `https://feed.localhost` reachable
|
|
from any browser, not just yours.
|
|
|
|
## Prerequisites
|
|
|
|
1. **`localhost` is on a Cloudflare account you control.** The DNS
|
|
nameservers for the domain need to be Cloudflare's. Check at
|
|
<https://dash.cloudflare.com/> — the zone should be Active.
|
|
2. **Local standalone server running** on `0.0.0.0:443` with the wildcard cert
|
|
that covers `*.localhost` (re-run `tools/patch-client.ps1` if your
|
|
cert is still the `+1` rec.net-only one — it'll regenerate as
|
|
`+3` covering both domains).
|
|
3. **Patched client** with `tools/patch-domain.ps1` so the in-game
|
|
URLs resolve to `*.localhost`. (Players using the public deployment
|
|
need to run this on their own client too.)
|
|
|
|
## One-shot setup
|
|
|
|
```powershell
|
|
PS C:\…\Recnet> .\tools\setup-cloudflared.ps1
|
|
```
|
|
|
|
The script:
|
|
1. Installs `cloudflared` via winget if missing.
|
|
2. Runs `cloudflared tunnel login` — opens a browser, you pick the
|
|
`localhost` zone, Cloudflare drops `cert.pem` into
|
|
`%USERPROFILE%\.cloudflared\`.
|
|
3. Creates a named tunnel called `dorknet` (or reuses one if it
|
|
already exists).
|
|
4. Generates `%USERPROFILE%\.cloudflared\config.yml` from the
|
|
`tools/cloudflared-config.yml.template` template, filling in the
|
|
tunnel id and credentials path.
|
|
5. Adds DNS CNAMEs for every localhost subdomain DorkNet uses
|
|
(api, auth, accounts, match, notify, ns, admin, feed, …).
|
|
|
|
## Run the tunnel
|
|
|
|
Foreground (for testing — Ctrl+C to stop):
|
|
|
|
```powershell
|
|
cloudflared tunnel run dorknet
|
|
```
|
|
|
|
Or install as a Windows service so it survives reboots:
|
|
|
|
```powershell
|
|
cloudflared service install
|
|
```
|
|
|
|
## Dokploy Microservices Sidecar
|
|
|
|
For Dokploy microservices, use
|
|
`docker-compose.microservices.dokploy.yml`. It starts `cloudflared` in
|
|
the same Compose network as `gateway`, so the tunnel origin is:
|
|
|
|
```text
|
|
http://gateway:8080
|
|
```
|
|
|
|
Set `CLOUDFLARE_TUNNEL_TOKEN` in Dokploy from the Cloudflare Zero Trust
|
|
tunnel token. In the Cloudflare tunnel's public hostnames, add:
|
|
|
|
```text
|
|
yourdomain.com -> http://gateway:8080
|
|
*.yourdomain.com -> http://gateway:8080
|
|
```
|
|
|
|
Do not add these domains in Dokploy's domain modal for this compose
|
|
stack; Cloudflare owns the public hostname routing.
|
|
|
|
## What Happens At Request Time
|
|
|
|
Local standalone tunnel:
|
|
|
|
```
|
|
visitor -> https://api.localhost/api/versioncheck/v4
|
|
-> Cloudflare edge
|
|
-> cloudflared tunnel
|
|
-> cloudflared running on your machine
|
|
-> https://localhost:443 (Host preserved)
|
|
-> DorkNet.Server
|
|
```
|
|
|
|
Dokploy microservices tunnel:
|
|
|
|
```
|
|
visitor -> https://api.yourdomain.com/api/versioncheck/v4
|
|
-> Cloudflare edge
|
|
-> cloudflared sidecar
|
|
-> http://gateway:8080 (Host preserved)
|
|
-> DorkNet.Gateway reverse proxy
|
|
-> dedicated service slice or monolith fallback
|
|
```
|
|
|
|
For the local standalone template, the leg from cloudflared to localhost
|
|
has `noTLSVerify: true` because the local server's cert is from mkcert
|
|
(private CA only trusted on your machine). The Cloudflare-edge to
|
|
cloudflared leg is still TLS-encrypted with Cloudflare's cert. In the
|
|
Dokploy microservices stack, the tunnel sidecar uses plain HTTP on the
|
|
private Compose network and sends everything to the gateway.
|
|
|
|
## Tearing down
|
|
|
|
```powershell
|
|
cloudflared service uninstall # if you ran service install
|
|
cloudflared tunnel delete dorknet
|
|
```
|
|
|
|
DNS records left behind in the Cloudflare dashboard need to be
|
|
deleted manually if you want them gone.
|
|
|
|
## Limits / caveats
|
|
|
|
- **Photon traffic is NOT proxied.** Cloudflare Tunnel is HTTP-only;
|
|
the realtime Photon connection still hits the public Photon Cloud
|
|
directly, with the AppId from your `appsettings.json`. That's fine
|
|
— Photon doesn't go through your server.
|
|
- **WebSocket support** is on by default in modern cloudflared, so
|
|
the SignalR notify hub works through the tunnel.
|
|
- **Free tier rate limits** — Cloudflare Free is generous for a
|
|
small private server but watch the dashboard if you scale up.
|