Files
headquarter/openspec/changes/cloudflare-tunnel-instances/tasks.md
T
Fusion b40eb3e88c feat(cloudflare-tunnel): integrate Cloudflare tunnels for instance access
Backend:
- Add cloudflare_tunnel.py service for creating/deleting tunnels via Cloudflare API
- Add public_url and tunnel_id fields to ToolInstance model
- Update start_instance to create Cloudflare tunnel after container starts
- Update stop_instance to delete tunnel before stopping container
- Update delete_instance to cleanup tunnel before deletion
- Update restart_instance to recreate tunnel on restart
- Create Alembic migration 0011 for tunnel fields
- Add Cloudflare config settings (API token, zone ID, account ID, base domain)

Infrastructure:
- Add cloudflared service to docker-compose.traefik.yml
- Mount shared cloudflared_config volume between API and cloudflared containers
- Add Cloudflare env vars to API service

Frontend:
- Update instance Open button to handle both full URLs and proxy paths

The instance URL is now set to the Cloudflare tunnel public URL when available,
falling back to the API proxy path if tunnel creation fails.
2026-05-20 14:25:06 +02:00

1.9 KiB

1. Infrastructure Setup

  • 1.1 Add cloudflared service to docker-compose.traefik.yml
  • 1.2 Create cloudflared config directory and base config
  • 1.3 Add Cloudflare env vars (API token, account ID, zone ID) to .env.example
  • 1.4 Mount shared config volume between API and cloudflared containers

2. Backend - Cloudflare Tunnel Service

  • 2.1 Create src/services/cloudflare_tunnel.py with tunnel CRUD operations
  • 2.2 Implement create_tunnel(instance_name, container_name, port) function
  • 2.3 Implement delete_tunnel(tunnel_id) function
  • 2.4 Implement update_cloudflared_config() to rewrite config.yml
  • 2.5 Add Cloudflare API token validation on startup

3. Backend - Instance Lifecycle Updates

  • 3.1 Update ToolInstance model: add tunnel_id and public_url fields
  • 3.2 Create Alembic migration for new fields
  • 3.3 Update start_instance to create tunnel and store public_url
  • 3.4 Update stop_instance to delete tunnel and DNS record
  • 3.5 Update delete_instance to ensure tunnel cleanup
  • 3.6 Update get_user_sessions to include public_url

4. Backend - Cleanup

  • 4.1 Remove instance_proxy.py router
  • 4.2 Remove proxy route registration from main.py
  • 4.3 Remove default_port from ToolType (no longer needed)
  • 4.4 Clean up any proxy-related code

5. Frontend Updates

  • 5.1 Update Session interface to include public_url
  • 5.2 Update InstanceList "Open" button to use public_url
  • 5.3 Update SessionsPage "Open" button to use public_url
  • 5.4 Remove proxy URL construction logic

6. Testing and Deployment

  • 6.1 Test tunnel creation with code-server instance
  • 6.2 Test tunnel deletion on instance stop
  • 6.3 Verify HTTPS and WebSocket support
  • 6.4 Run quality gates (ruff, mypy, typecheck, lint, build)
  • 6.5 Deploy and test end-to-end