mirror of
https://github.com/DorkSquadRR/DorkNet.git
synced 2026-10-26 15:38:45 -07:00
Alexa
4edf25b2d5
Targets Rec Room 2020.12.18 client.
Re-import after adding:
- DorkNet.ClientMod/dorknet-clientmod.json.template — config schema
the launcher's manifest-driven patcher renders into UserData/.
- tools/build-patcher-zip.ps1 — produces the dorknet-clientpatch-{key}.zip
Release asset the launcher fetches.
- .github/workflows/release.yml — auto-publishes both Release assets
on v1-december-* tag push.
Scrubbed via maintainer-side scrub-for-public.ps1: same drop rules as
the prior import, plus build-patcher-zip.ps1 added to the tools/
allow-list so it survives the scrub.
100 lines
3.5 KiB
Markdown
100 lines
3.5 KiB
Markdown
# Cloudflare Tunnel for `localhost`
|
|
|
|
Stand up a Cloudflare Tunnel that exposes your local DorkNet server
|
|
on `*.localhost` for public testing — without opening port 443 on your
|
|
firewall, and using Cloudflare's real Let's-Encrypt-equivalent cert
|
|
edge-side so visitors don't need your mkcert CA installed.
|
|
|
|
## When to use this
|
|
|
|
- You want a friend to play the patched 2020 Rec Room client against
|
|
your server, but they're not on your LAN and don't want to install
|
|
your local CA.
|
|
- You want `https://admin.localhost` / `https://feed.localhost` reachable
|
|
from any browser, not just yours.
|
|
|
|
## Prerequisites
|
|
|
|
1. **`localhost` is on a Cloudflare account you control.** The DNS
|
|
nameservers for the domain need to be Cloudflare's. Check at
|
|
<https://dash.cloudflare.com/> — the zone should be Active.
|
|
2. **Local server running** on `0.0.0.0:443` with the wildcard cert
|
|
that covers `*.localhost` (re-run `tools/patch-client.ps1` if your
|
|
cert is still the `+1` rec.net-only one — it'll regenerate as
|
|
`+3` covering both domains).
|
|
3. **Patched client** with `tools/patch-domain.ps1` so the in-game
|
|
URLs resolve to `*.localhost`. (Players using the public deployment
|
|
need to run this on their own client too.)
|
|
|
|
## One-shot setup
|
|
|
|
```powershell
|
|
PS C:\…\Recnet> .\tools\setup-cloudflared.ps1
|
|
```
|
|
|
|
The script:
|
|
1. Installs `cloudflared` via winget if missing.
|
|
2. Runs `cloudflared tunnel login` — opens a browser, you pick the
|
|
`localhost` zone, Cloudflare drops `cert.pem` into
|
|
`%USERPROFILE%\.cloudflared\`.
|
|
3. Creates a named tunnel called `dorknet` (or reuses one if it
|
|
already exists).
|
|
4. Generates `%USERPROFILE%\.cloudflared\config.yml` from the
|
|
`tools/cloudflared-config.yml.template` template, filling in the
|
|
tunnel id and credentials path.
|
|
5. Adds DNS CNAMEs for every localhost subdomain DorkNet uses
|
|
(api, auth, accounts, match, notify, ns, admin, feed, …).
|
|
|
|
## Run the tunnel
|
|
|
|
Foreground (for testing — Ctrl+C to stop):
|
|
|
|
```powershell
|
|
cloudflared tunnel run dorknet
|
|
```
|
|
|
|
Or install as a Windows service so it survives reboots:
|
|
|
|
```powershell
|
|
cloudflared service install
|
|
```
|
|
|
|
## What happens at request time
|
|
|
|
```
|
|
visitor → https://api.localhost/api/versioncheck/v4
|
|
→ Cloudflare edge (real LE cert, validated)
|
|
→ cloudflared tunnel
|
|
→ cloudflared (running on your machine)
|
|
→ https://localhost:443 (Host: api.localhost, mkcert cert)
|
|
→ DorkNet.Server matches [Host("api.localhost")] → handler runs
|
|
```
|
|
|
|
The leg from cloudflared → localhost has `noTLSVerify: true` because
|
|
the local server's cert is from mkcert (private CA only trusted on
|
|
your machine). The Cloudflare-edge → cloudflared leg is still
|
|
TLS-encrypted with their cert, so this isn't a security weakening
|
|
— it's just acknowledging that "127.0.0.1 with self-trusted cert" is
|
|
where the trust chain ends.
|
|
|
|
## Tearing down
|
|
|
|
```powershell
|
|
cloudflared service uninstall # if you ran service install
|
|
cloudflared tunnel delete dorknet
|
|
```
|
|
|
|
DNS records left behind in the Cloudflare dashboard need to be
|
|
deleted manually if you want them gone.
|
|
|
|
## Limits / caveats
|
|
|
|
- **Photon traffic is NOT proxied.** Cloudflare Tunnel is HTTP-only;
|
|
the realtime Photon connection still hits the public Photon Cloud
|
|
directly, with the AppId from your `appsettings.json`. That's fine
|
|
— Photon doesn't go through your server.
|
|
- **WebSocket support** is on by default in modern cloudflared, so
|
|
the SignalR notify hub works through the tunnel.
|
|
- **Free tier rate limits** — Cloudflare Free is generous for a
|
|
small private server but watch the dashboard if you scale up.
|