headquarter/openspec/changes/archive/2026-05-22-cloudflare-tunnel-instances-superseded/specs/cloudflare-tunnel-management/spec.md at 1c9458330700dc23089409df5ff4668a984f7f9f

Files

T

Fusion 2a9e57ad0d chore: archive superseded cloudflare-tunnel-instances OpenSpec change

This change proposed using Cloudflare API for persistent tunnels.
Superseded by temporary tunnel approach using 'cloudflared tunnel --url'
which requires no API tokens, account IDs, or DNS configuration.

2026-05-22 21:01:44 +02:00

2.1 KiB

Raw Blame History

ADDED Requirements

Requirement: System creates Cloudflare tunnel on instance start

When a tool instance is started, the system SHALL create a Cloudflare tunnel and DNS record to expose it publicly.

Scenario: Start instance creates tunnel

WHEN a user starts a tool instance
THEN the system calls the Cloudflare API to create a tunnel
AND creates a CNAME DNS record for instance-{id}.{zone}
AND stores the tunnel ID and public URL in the database

Scenario: Tunnel points to correct container

WHEN a tunnel is created for an instance
THEN the tunnel ingress rule maps the subdomain to the container's internal DNS name and port

Requirement: System deletes Cloudflare tunnel on instance stop

When a tool instance is stopped or deleted, the system SHALL clean up the associated Cloudflare tunnel and DNS record.

Scenario: Stop instance deletes tunnel

WHEN a user stops a running instance
THEN the system deletes the DNS record
AND deletes the Cloudflare tunnel

Scenario: Delete instance cleans up tunnel

WHEN a user deletes an instance
AND the instance has an active tunnel
THEN the system deletes both the DNS record and the tunnel

Requirement: Frontend uses public URL for instance access

The frontend SHALL display and link to the public Cloudflare URL for running instances.

Scenario: Open button uses public URL

WHEN a user views a running instance
THEN the "Open" button links to the instance's public URL
AND the URL opens in a new tab

Scenario: Session list shows public URL

WHEN a user views their sessions
THEN each running session displays its public URL

Requirement: Only instance owner can start/stop/delete tunnels

The system SHALL verify that only the instance owner can trigger tunnel creation or deletion.

Scenario: Owner starts instance

WHEN the instance owner clicks "Start"
THEN the tunnel is created successfully

Scenario: Non-owner attempts to start

WHEN a non-owner attempts to start an instance
THEN the request returns 403 Forbidden

2.1 KiB Raw Blame History