feat(cloudflare-tunnel): integrate Cloudflare tunnels for instance access
Backend: - Add cloudflare_tunnel.py service for creating/deleting tunnels via Cloudflare API - Add public_url and tunnel_id fields to ToolInstance model - Update start_instance to create Cloudflare tunnel after container starts - Update stop_instance to delete tunnel before stopping container - Update delete_instance to cleanup tunnel before deletion - Update restart_instance to recreate tunnel on restart - Create Alembic migration 0011 for tunnel fields - Add Cloudflare config settings (API token, zone ID, account ID, base domain) Infrastructure: - Add cloudflared service to docker-compose.traefik.yml - Mount shared cloudflared_config volume between API and cloudflared containers - Add Cloudflare env vars to API service Frontend: - Update instance Open button to handle both full URLs and proxy paths The instance URL is now set to the Cloudflare tunnel public URL when available, falling back to the API proxy path if tunnel creation fails.
This commit is contained in:
Fusion
@@ -0,0 +1,268 @@
|
||||
"""Cloudflare Tunnel management service."""
|
||||
|
||||
import json
|
||||
import logging
|
||||
import os
|
||||
import uuid
|
||||
from pathlib import Path
|
||||
|
||||
import httpx
|
||||
from src.config import Settings
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4"
|
||||
|
||||
|
||||
def _get_headers(settings: Settings) -> dict[str, str]:
|
||||
"""Get Cloudflare API headers."""
|
||||
return {
|
||||
"Authorization": f"Bearer {settings.cloudflare_api_token}",
|
||||
"Content-Type": "application/json",
|
||||
}
|
||||
|
||||
|
||||
async def create_tunnel(
|
||||
instance_name: str,
|
||||
instance_id: str,
|
||||
settings: Settings | None = None,
|
||||
) -> dict[str, str]:
|
||||
"""Create a Cloudflare tunnel for an instance.
|
||||
|
||||
Args:
|
||||
instance_name: Name of the instance (used for tunnel name)
|
||||
instance_id: UUID of the instance
|
||||
settings: Optional settings override
|
||||
|
||||
Returns:
|
||||
Dict with tunnel_id and public_url
|
||||
"""
|
||||
if settings is None:
|
||||
settings = Settings()
|
||||
|
||||
if not settings.cloudflare_api_token:
|
||||
raise ValueError("CLOUDFLARE_API_TOKEN not configured")
|
||||
|
||||
headers = _get_headers(settings)
|
||||
account_id = settings.cloudflare_account_id
|
||||
|
||||
# Create tunnel
|
||||
async with httpx.AsyncClient() as client:
|
||||
response = await client.post(
|
||||
f"{CLOUDFLARE_API_BASE}/accounts/{account_id}/cfd_tunnel",
|
||||
headers=headers,
|
||||
json={
|
||||
"name": f"headquarter-{instance_name}",
|
||||
"config_src": "cloudflare",
|
||||
},
|
||||
)
|
||||
response.raise_for_status()
|
||||
data = response.json()
|
||||
|
||||
if not data.get("success"):
|
||||
raise ValueError(f"Failed to create tunnel: {data.get('errors')}")
|
||||
|
||||
tunnel = data["result"]
|
||||
tunnel_id = tunnel["id"]
|
||||
|
||||
# Get tunnel token
|
||||
token_response = await client.get(
|
||||
f"{CLOUDFLARE_API_BASE}/accounts/{account_id}/cfd_tunnel/{tunnel_id}/token",
|
||||
headers=headers,
|
||||
)
|
||||
token_response.raise_for_status()
|
||||
token_data = token_response.json()
|
||||
tunnel_token = token_data["result"]
|
||||
|
||||
# Create DNS record for the tunnel
|
||||
subdomain = f"instance-{instance_id[:8]}"
|
||||
hostname = f"{subdomain}.{settings.cloudflare_base_domain}"
|
||||
|
||||
dns_response = await client.post(
|
||||
f"{CLOUDFLARE_API_BASE}/zones/{settings.cloudflare_zone_id}/dns_records",
|
||||
headers=headers,
|
||||
json={
|
||||
"type": "CNAME",
|
||||
"name": subdomain,
|
||||
"content": f"{tunnel_id}.cfargotunnel.com",
|
||||
"ttl": 1,
|
||||
"proxied": True,
|
||||
},
|
||||
)
|
||||
dns_response.raise_for_status()
|
||||
|
||||
# Update cloudflared config
|
||||
await update_cloudflared_config(
|
||||
tunnel_id=tunnel_id,
|
||||
tunnel_token=tunnel_token,
|
||||
hostname=hostname,
|
||||
instance_name=instance_name,
|
||||
settings=settings,
|
||||
)
|
||||
|
||||
return {
|
||||
"tunnel_id": tunnel_id,
|
||||
"public_url": f"https://{hostname}",
|
||||
"subdomain": subdomain,
|
||||
}
|
||||
|
||||
|
||||
async def delete_tunnel(
|
||||
tunnel_id: str,
|
||||
subdomain: str,
|
||||
settings: Settings | None = None,
|
||||
) -> None:
|
||||
"""Delete a Cloudflare tunnel and its DNS record.
|
||||
|
||||
Args:
|
||||
tunnel_id: Cloudflare tunnel ID
|
||||
subdomain: Subdomain to remove DNS record for
|
||||
settings: Optional settings override
|
||||
"""
|
||||
if settings is None:
|
||||
settings = Settings()
|
||||
|
||||
if not settings.cloudflare_api_token:
|
||||
raise ValueError("CLOUDFLARE_API_TOKEN not configured")
|
||||
|
||||
headers = _get_headers(settings)
|
||||
account_id = settings.cloudflare_account_id
|
||||
|
||||
async with httpx.AsyncClient() as client:
|
||||
# Delete DNS record
|
||||
# First find the DNS record ID
|
||||
dns_list = await client.get(
|
||||
f"{CLOUDFLARE_API_BASE}/zones/{settings.cloudflare_zone_id}/dns_records",
|
||||
headers=headers,
|
||||
params={"name": f"{subdomain}.{settings.cloudflare_base_domain}"},
|
||||
)
|
||||
dns_list.raise_for_status()
|
||||
dns_data = dns_list.json()
|
||||
|
||||
if dns_data.get("success") and dns_data.get("result"):
|
||||
for record in dns_data["result"]:
|
||||
await client.delete(
|
||||
f"{CLOUDFLARE_API_BASE}/zones/{settings.cloudflare_zone_id}/dns_records/{record['id']}",
|
||||
headers=headers,
|
||||
)
|
||||
|
||||
# Delete tunnel
|
||||
await client.delete(
|
||||
f"{CLOUDFLARE_API_BASE}/accounts/{account_id}/cfd_tunnel/{tunnel_id}",
|
||||
headers=headers,
|
||||
)
|
||||
|
||||
# Remove from cloudflared config
|
||||
await remove_tunnel_from_config(tunnel_id, settings)
|
||||
|
||||
|
||||
async def update_cloudflared_config(
|
||||
tunnel_id: str,
|
||||
tunnel_token: str,
|
||||
hostname: str,
|
||||
instance_name: str,
|
||||
settings: Settings | None = None,
|
||||
) -> None:
|
||||
"""Update the cloudflared config.yml with a new tunnel.
|
||||
|
||||
Args:
|
||||
tunnel_id: Cloudflare tunnel ID
|
||||
tunnel_token: Tunnel token for authentication
|
||||
hostname: Public hostname for the tunnel
|
||||
instance_name: Instance name for the service
|
||||
settings: Optional settings override
|
||||
"""
|
||||
if settings is None:
|
||||
settings = Settings()
|
||||
|
||||
config_dir = Path(settings.cloudflared_config_dir)
|
||||
config_file = config_dir / "config.yml"
|
||||
credentials_file = config_dir / f"{tunnel_id}.json"
|
||||
|
||||
# Ensure config directory exists
|
||||
config_dir.mkdir(parents=True, exist_ok=True)
|
||||
|
||||
# Write tunnel credentials
|
||||
credentials = {
|
||||
"AccountTag": settings.cloudflare_account_id,
|
||||
"TunnelID": tunnel_id,
|
||||
"TunnelName": f"headquarter-{instance_name}",
|
||||
"TunnelSecret": tunnel_token,
|
||||
}
|
||||
with open(credentials_file, "w") as f:
|
||||
json.dump(credentials, f, indent=2)
|
||||
|
||||
# Read existing config or create new one
|
||||
config: dict = {"tunnel": "", "credentials-file": "", "ingress": []}
|
||||
if config_file.exists():
|
||||
import yaml
|
||||
with open(config_file, "r") as f:
|
||||
config = yaml.safe_load(f) or config
|
||||
|
||||
# Update tunnel and credentials-file (should point to latest)
|
||||
config["tunnel"] = tunnel_id
|
||||
config["credentials-file"] = str(credentials_file)
|
||||
|
||||
# Add ingress rule for this instance
|
||||
ingress_rule = {
|
||||
"hostname": hostname,
|
||||
"service": f"http://{instance_name}:8080",
|
||||
}
|
||||
|
||||
# Remove existing rule for this hostname if present
|
||||
config["ingress"] = [
|
||||
rule for rule in config.get("ingress", [])
|
||||
if rule.get("hostname") != hostname
|
||||
]
|
||||
|
||||
# Add new rule and catch-all
|
||||
config["ingress"].append(ingress_rule)
|
||||
config["ingress"].append({"service": "http_status:404"})
|
||||
|
||||
# Write updated config
|
||||
import yaml
|
||||
with open(config_file, "w") as f:
|
||||
yaml.dump(config, f, default_flow_style=False)
|
||||
|
||||
logger.info("Updated cloudflared config for tunnel %s", tunnel_id)
|
||||
|
||||
|
||||
async def remove_tunnel_from_config(
|
||||
tunnel_id: str,
|
||||
settings: Settings | None = None,
|
||||
) -> None:
|
||||
"""Remove a tunnel from the cloudflared config.
|
||||
|
||||
Args:
|
||||
tunnel_id: Cloudflare tunnel ID to remove
|
||||
settings: Optional settings override
|
||||
"""
|
||||
if settings is None:
|
||||
settings = Settings()
|
||||
|
||||
config_dir = Path(settings.cloudflared_config_dir)
|
||||
config_file = config_dir / "config.yml"
|
||||
credentials_file = config_dir / f"{tunnel_id}.json"
|
||||
|
||||
if not config_file.exists():
|
||||
return
|
||||
|
||||
import yaml
|
||||
with open(config_file, "r") as f:
|
||||
config = yaml.safe_load(f) or {}
|
||||
|
||||
# Remove ingress rules for this tunnel
|
||||
config["ingress"] = [
|
||||
rule for rule in config.get("ingress", [])
|
||||
if rule.get("hostname") != f"instance-{tunnel_id[:8]}.{settings.cloudflare_base_domain}"
|
||||
]
|
||||
|
||||
# Write updated config
|
||||
with open(config_file, "w") as f:
|
||||
yaml.dump(config, f, default_flow_style=False)
|
||||
|
||||
# Remove credentials file
|
||||
if credentials_file.exists():
|
||||
credentials_file.unlink()
|
||||
|
||||
logger.info("Removed tunnel %s from cloudflared config", tunnel_id)
|
||||
Reference in New Issue
Block a user