Fusion
b40eb3e88c
Backend: - Add cloudflare_tunnel.py service for creating/deleting tunnels via Cloudflare API - Add public_url and tunnel_id fields to ToolInstance model - Update start_instance to create Cloudflare tunnel after container starts - Update stop_instance to delete tunnel before stopping container - Update delete_instance to cleanup tunnel before deletion - Update restart_instance to recreate tunnel on restart - Create Alembic migration 0011 for tunnel fields - Add Cloudflare config settings (API token, zone ID, account ID, base domain) Infrastructure: - Add cloudflared service to docker-compose.traefik.yml - Mount shared cloudflared_config volume between API and cloudflared containers - Add Cloudflare env vars to API service Frontend: - Update instance Open button to handle both full URLs and proxy paths The instance URL is now set to the Cloudflare tunnel public URL when available, falling back to the API proxy path if tunnel creation fails.
31 lines
2.1 KiB
Markdown
31 lines
2.1 KiB
Markdown
## Why
|
|
|
|
The current approach of proxying tool instances through the backend API is fragile and creates a bottleneck. Every HTTP request and WebSocket connection to a tool instance (code-server, jupyter, etc.) must pass through the FastAPI application, adding latency and consuming API resources. Cloudflare Tunnel provides a robust alternative: each instance gets its own public subdomain with automatic HTTPS, without exposing ports or requiring complex reverse proxy rules.
|
|
|
|
## What Changes
|
|
|
|
- Replace the API proxy endpoint (`/instances/{id}/proxy/`) with Cloudflare Tunnel integration
|
|
- Run a `cloudflared` container alongside the API that manages tunnels programmatically via the Cloudflare API
|
|
- When a tool instance starts, create a unique Cloudflare Tunnel and DNS record pointing to the instance's internal container name and port
|
|
- Store the public URL (e.g., `https://instance-abc123.headquarter.commumedia.org`) in the ToolInstance model
|
|
- Update the frontend "Open" button to use the Cloudflare URL instead of the proxy path
|
|
- Remove the proxy endpoint and related code (instance_proxy.py)
|
|
- **BREAKING**: The `/instances/{id}/proxy/{path:path}` endpoint will be removed
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
|
|
- `cloudflare-tunnel-management`: Creating, deleting, and managing Cloudflare tunnels for tool instances via the Cloudflare API
|
|
|
|
### Modified Capabilities
|
|
|
|
- `instance-proxy`: The current proxy-based approach will be replaced by Cloudflare tunnels. The requirement that "The API SHALL expose an endpoint that forwards HTTP requests" is replaced by "The system SHALL provide a public URL for each running instance."
|
|
|
|
## Impact
|
|
|
|
- Backend: New Cloudflare tunnel service, updated instance lifecycle (create tunnel on start, delete on stop), removed proxy code
|
|
- Frontend: Update "Open" links to use public Cloudflare URLs
|
|
- Infrastructure: New `cloudflared` Docker service, Cloudflare API token required
|
|
- Environment: New env vars: `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_ZONE_ID`
|
|
- Docker: Cloudflared container must be on the same network as tool instances |