41 lines
2.2 KiB
Markdown
41 lines
2.2 KiB
Markdown
---
|
|
title: Cloudflare Tunnel
|
|
type: system
|
|
status: active
|
|
created: 2026-07-22
|
|
updated: 2026-07-22
|
|
verified_on: 2026-07-22
|
|
confidence: high
|
|
tags: [system, network, cloudflare]
|
|
sources: [raw/configs/hermes-config-sanitized.txt]
|
|
---
|
|
|
|
# Cloudflare Tunnel
|
|
|
|
## Purpose
|
|
Exposes internal homelab services, including Hermes, to the public internet without opening inbound firewall ports.
|
|
|
|
## Location
|
|
- **Runs on:** ct207 "webserver" (Tailscale `100.82.40.23`), **not** on this host.
|
|
- **Binary:** `/bin/cloudflared`
|
|
- **Service:** `cloudflared.service` (systemd, active/running on ct207)
|
|
- **Tunnel name / ID:** `ct207-tunnel` / `339a6757-5574-4723-a16c-da4769535caa`
|
|
- **Config:** `/etc/cloudflared/config.yml` on ct207; credentials file `339a6757-5574-4723-a16c-da4769535caa.json` in the same directory (not read/copied here — credential material, not a fact to mirror).
|
|
|
|
## Current configuration
|
|
- `originRequest`: `noTLSVerify: true`, `disableChunkedEncoding: true`, `http2Origin: false` (global defaults; some hostnames override per-entry)
|
|
- Ingress is a flat list of `hostname → service` mappings ending in `service: http_status:404` catch-all — see [[infrastructure/domains-and-tunnels]] for the full list and the entries specific to Hermes.
|
|
- Two Hermes-relevant entries point at this host's Tailscale IP (`100.118.5.51`): `hermes.martinwa.org` (port 19119) and `hermes-desktop.martinwa.org` (port 5174).
|
|
|
|
## Connected systems
|
|
- [[systems/hermes-agent]] — the service actually reached through this tunnel
|
|
- [[infrastructure/domains-and-tunnels]] — full hostname table
|
|
- [[infrastructure/network-map]]
|
|
|
|
## Known issues
|
|
- This host cannot restart or inspect the tunnel directly (no `cloudflared` installed here); a tunnel-side problem requires access to ct207.
|
|
- `mcp-portal.martinwa.org`, referenced in Hermes's own config as an MCP endpoint, was not found in the ct207 ingress list captured 2026-07-22 — **unresolved**, may be on a different tunnel/host.
|
|
|
|
## Relevant runbooks
|
|
- [[runbooks/diagnose-docker]] (closest existing runbook; no dedicated tunnel-restart runbook exists yet — worth writing one that documents `systemctl restart cloudflared` on ct207, since Hermes has no direct access to perform it)
|