From fad3854c05edae505ee30eeb225748fa0b97b878 Mon Sep 17 00:00:00 2001 From: xnoto Date: Fri, 28 Aug 2026 14:54:00 -0600 Subject: [PATCH] feat: reacquire durable Cloudflare tunnel --- AGENTS.md | 2 +- .../cloudflare/cloudflare-api-credentials-secret.yaml | 9 +++++---- operators/cloudflare/cluster-tunnel.yaml | 4 +++- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index cb88365..aa5bc24 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -18,7 +18,7 @@ Read the closest nested `AGENTS.md` before changing a subtree. Preserve Kustomiz ## Cross-repository ownership - `charts/opencode-server` owns the packaged OpenCode server chart. Its post-publish workflow opens or updates a `kustomize-cluster` pull request that pins the `opencode` Application to the immutable published version. The generated PR must pass cluster CI and be reviewed and merged before GitOps reconciles it; the automation never syncs Argo CD or deploys directly. -- `tfroot-cloudflare` owns bootstrap/non-tunnel Cloudflare infrastructure. Workload TunnelBinding resources own workload routes and DNS. +- `tfroot-cloudflare` owns the durable cluster tunnel identity, bootstrap DNS, and non-tunnel Cloudflare infrastructure. `ClusterTunnel` references that tunnel with `existingTunnel`; workload `TunnelBinding` resources own local ingress routes and workload DNS. - `images` owns shared runner images; `shared-workflows` owns reusable Actions. ## Secrets and validation diff --git a/operators/cloudflare/cloudflare-api-credentials-secret.yaml b/operators/cloudflare/cloudflare-api-credentials-secret.yaml index b665c0e..2507d7b 100644 --- a/operators/cloudflare/cloudflare-api-credentials-secret.yaml +++ b/operators/cloudflare/cloudflare-api-credentials-secret.yaml @@ -6,10 +6,10 @@ metadata: type: Opaque stringData: CLOUDFLARE_API_TOKEN: ENC[AES256_GCM,data:zSq5DmP+DWrXHiza0Ki4/S1je6YZGA1oG6nSrlHmp56l6aSdsLEB/Q==,iv:7y5BzcFGxDSaaw0NJB5MxXAGWi3/sQZJcWtgc72JSnA=,tag:M7yHQ5YbsaL3STxKWKxNaQ==,type:str] + credentials.json: ENC[AES256_GCM,data:QXiz2QcEAeI4qibPZrRbzXKJ2PJzlhfpHFClzQK5EIUO3wgQvvUS9hTAphOdSrOoDOoUNiAQfB542b5sYMwgiLEqywHSFiW4i3qOdxSTH8cBheedm9/L2FhqqKeQKNgYtThKvFwcluFwUsWAvaO2Y2sqQ8LhIdu+rrS39yATJmvRaIRVNVajCAvhb0DDCnIk3Ok8EOrreNqEBp3HZ3I23/U=,iv:6dsGyW+/f25FDLrNKW6NOULuheIq9WM58E5mV1fpRpc=,tag:X1tI9hfpfUxxSYgbvt5/cA==,type:str] sops: age: - - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RFozVmRlWXQ5NG5MUVkx NjEvTWpzSFluRit5RXkxN3JvQTByK2xYdkZvCnlYVlgxUFhMVGVFZjBJOFFZQVJL @@ -17,7 +17,8 @@ sops: N1hnem5VTkw5TTZZUk9mNy81MTAybzQKW5r9MJJ6qxyS7mWNoD6PSL19Ncm6SZ9u m8KdBqQ2Krfsg/QiCn91tEZZvtdckGSOfxeYNZsBrDXRgNFyo4KWBQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-03-16T14:38:08Z" - mac: ENC[AES256_GCM,data:FQ3vjAMbIkMOlvIHr6flHE8ff3nbUXEQpdq1XPh7x6HYoY/F5OJ7c3Lns1UZRiecdut2AA9Bduld+fFxfw1W5d7uCjOQSdXF99XC/sV+iAtpzWiRsPQTnTUWYFSrUV8z/aul7TSxNGfQaZFawcygBXVjkTdnQHYq/jLeouGVJpU=,iv:8fWPPjFIed0UYOFPm7/ZYUpg0gj4QF03jHcOQdfteqM=,tag:z/Np14ikz/3phxBM+7COyA==,type:str] + recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.github\.clientID|dex\.github\.clientSecret)$ + lastmodified: "2026-08-28T20:48:00Z" + mac: ENC[AES256_GCM,data:bf1fba9aDgnnh8VXqg3+FIHg7rncRp6HTsQ5eWGvd0JRgb4zbqWceH6LlueQuD6EhXnxui4J1qmTctcVmo0AzP8WgfYQBHK+uxHHIpcWPfv6wiDSfKsKR2A8ECW5NhW0cIExbNoMRtQ+dp1VWXoT0fa7TQTE3ZxO8VOljwOMXD0=,iv:+jYV5UQJGwmmimDzSNywGQMf+P+kHUmLsA7T8Z7kt3o=,tag:cUWrmUNaSPF3sECINQO7Sg==,type:str] version: 3.12.1 diff --git a/operators/cloudflare/cluster-tunnel.yaml b/operators/cloudflare/cluster-tunnel.yaml index 2db6708..028de04 100644 --- a/operators/cloudflare/cluster-tunnel.yaml +++ b/operators/cloudflare/cluster-tunnel.yaml @@ -6,13 +6,15 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "0" spec: - newTunnel: + existingTunnel: + id: d17bee03-8687-46a7-831b-df48aacdea1e name: cluster-apps-k3s cloudflare: accountId: "03f750691b4ad4d59aa4b7205adaa108" domain: makeitwork.cloud secret: cloudflare-api-credentials CLOUDFLARE_API_TOKEN: CLOUDFLARE_API_TOKEN + CLOUDFLARE_TUNNEL_CREDENTIAL_FILE: credentials.json fallbackTarget: http_status:404 deployPatch: | spec: