feat(tunnel): N4 — cloudflared wrapper + ingress + secret refusal; CI skips docs - #23
Merged
Conversation
… skips docs internal/tunnel manages the optional, default-down, account-gated public tunnel (spec 05), behind an injectable Runner so it is fully unit-testable without the binary or a Cloudflare account: - Available / Login / Create(name) / RouteDNS(name, host) / Run(config). RouteDNS refuses a wildcard with the manual-CNAME remediation (cloudflared rejects `*`). - IngressConfig renders a deterministic cloudflared config.yml whose ingress maps every public hostname → the shared Caddy upstream (public reuses local routing, no drift) with the required 404 catch-all last. - SecretBearing returns the NON-local secret:// refs in a service's env so a tunnel refuses to expose a service carrying remote secrets without override (a nil/unknown classifier fails safe → treats all as non-local). - CLI `tunnel login|create|route` replaces the stub (account verbs); running the tunnel container with routes-derived ingress is wired into the saga (N5). CI: add `paths-ignore` for `**/*.md`/docs/LICENSE/NOTICE so docs-only PRs skip the now-heavier consolidated lane (the e2e step made every PR ~4.5 min). Unit-tested (fake runner): available, verbs-need-binary, create+route call-through, wildcard refusal, empty-name error, deterministic ingress rendering + 404 last, SecretBearing local-vs-nonlocal (+ fail-safe nil). CLI registration test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chunk N4 (M5)
internal/tunnelmanages the optional, default-down, account-gated public tunnel (spec 05), behind an injectable Runner (fully unit-testable without cloudflared or a Cloudflare account):Available/Login/Create(name)/RouteDNS(name, host)/Run(config).RouteDNSrefuses a wildcard with the manual-CNAME remediation (cloudflared rejects*).IngressConfigrenders a deterministic cloudflaredconfig.ymlmapping every public hostname → the shared Caddy upstream (public reuses local routing, no drift) + the required404catch-all last.SecretBearingreturns the non-localsecret://refs in a service's env so a tunnel refuses to expose a service carrying remote secrets without override (nil/unknown classifier fails safe).tunnel login|create|routereplaces the stub (account verbs); running the tunnel container with routes-derived ingress is the saga's job (N5).CI efficiency
Adds
paths-ignorefor**/*.md/docs//LICENSE/NOTICEso docs-only PRs skip the consolidated lane (the e2e step made every PR ~4.5 min).Tests
Fake runner: available, verbs-need-binary, create+route call-through, wildcard refusal, empty-name error, deterministic ingress + 404-last,
SecretBearinglocal-vs-non-local (+ fail-safe nil). CLI registration.Gate
make cigreen (race).🤖 Generated with Claude Code