## 1. Infrastructure Setup

- [ ] 1.1 Add cloudflared service to docker-compose.traefik.yml
- [ ] 1.2 Create cloudflared config directory and base config
- [ ] 1.3 Add Cloudflare env vars (API token, account ID, zone ID) to .env.example
- [ ] 1.4 Mount shared config volume between API and cloudflared containers

## 2. Backend - Cloudflare Tunnel Service

- [ ] 2.1 Create `src/services/cloudflare_tunnel.py` with tunnel CRUD operations
- [ ] 2.2 Implement `create_tunnel(instance_name, container_name, port)` function
- [ ] 2.3 Implement `delete_tunnel(tunnel_id)` function
- [ ] 2.4 Implement `update_cloudflared_config()` to rewrite config.yml
- [ ] 2.5 Add Cloudflare API token validation on startup

## 3. Backend - Instance Lifecycle Updates

- [ ] 3.1 Update ToolInstance model: add `tunnel_id` and `public_url` fields
- [ ] 3.2 Create Alembic migration for new fields
- [ ] 3.3 Update `start_instance` to create tunnel and store public_url
- [ ] 3.4 Update `stop_instance` to delete tunnel and DNS record
- [ ] 3.5 Update `delete_instance` to ensure tunnel cleanup
- [ ] 3.6 Update `get_user_sessions` to include `public_url`

## 4. Backend - Cleanup

- [ ] 4.1 Remove `instance_proxy.py` router
- [ ] 4.2 Remove proxy route registration from `main.py`
- [ ] 4.3 Remove `default_port` from ToolType (no longer needed)
- [ ] 4.4 Clean up any proxy-related code

## 5. Frontend Updates

- [ ] 5.1 Update Session interface to include `public_url`
- [ ] 5.2 Update InstanceList "Open" button to use `public_url`
- [ ] 5.3 Update SessionsPage "Open" button to use `public_url`
- [ ] 5.4 Remove proxy URL construction logic

## 6. Testing and Deployment

- [ ] 6.1 Test tunnel creation with code-server instance
- [ ] 6.2 Test tunnel deletion on instance stop
- [ ] 6.3 Verify HTTPS and WebSocket support
- [ ] 6.4 Run quality gates (ruff, mypy, typecheck, lint, build)
- [ ] 6.5 Deploy and test end-to-end