Skip to main content

Cloudflare Tunnel

Repo: iac-api-gateway
File: gateway/tunnel.tf

One centralized tunnel per environment: eigenoid-gateway-{env}.

Key design choices​

  • config_src = "cloudflare" — tunnel ingress config lives in Cloudflare's API, not on the VM. cloudflared fetches its config at startup and receives live updates when ingress rules change. Changing only tunnel.tf ingress rules does not require a VM restart.
  • All ingress rules map to http://localhost:8080 (cf-proxy). cf-proxy is responsible for routing to the correct Cloud Run service based on the Host header.
  • A catch-all rule returns http_status:404 for unmatched hostnames.

Current ingress rules (dev)​

HostnameService
api-admin-internal-dev.eigenoid.serviceshttp://localhost:8080
api-public-internal-dev.eigenoid.serviceshttp://localhost:8080
(catch-all)http_status:404

DNS​

Both api-*-internal-{env}.eigenoid.services records are CNAME → {tunnel-id}.cfargotunnel.com (proxied). Managed in gateway/dns.tf.

Note on enable_dns_switch: dns.tf gates these records behind var.enable_dns_switch. During initial rollout the switch is false to allow verification before live traffic is affected. Once flipped, the old CNAME records in iac-access must be removed to prevent Terraform drift.