feat(cloudflare): multi-hostname tunnel via domain/cloudflare model (sprint 4)

Author: devalade

src/cli/commands/cloudflare.ts

@@ -30,7 +30,9 @@ export async function cmdCloudflareAudit(
     const orchestrator = new CloudflareOrchestrator(executor, config, requireToken());
     const result = await orchestrator.audit();
     console.log(`  Zone: ${result.zone.name} (${result.zone.id}) — ${result.zone.status}`);
-    if (result.dns) console.log(`  DNS: ${result.dns}`);
+    for (const app of result.apps) {
+      console.log(`  DNS ${app.domain} → localhost:${app.port}`);
+    }
     console.log(`  cloudflared tunnels:\n${result.tunnelList}`);
     console.log(`  cloudflared service: ${result.service}`);
   }, { configPath: options.config });

src/config/schema.ts

@@ -69,7 +69,6 @@ export const BackupConfigSchema = z.object({
 
 export const CloudflareConfigSchema = z.object({
   zone: z.string().min(1, 'Cloudflare zone is required'),
-  appHostname: z.string().optional(),
   sshHostname: z.string().optional(),
   tunnelName: z.string().optional(),
   lockdownFirewall: z.boolean().default(false),

src/domain/cloudflare/ingress.ts

@@ -0,0 +1,4 @@
+export interface Ingress {
+  hostname?: string;
+  service: string;
+}

src/domain/cloudflare/tunnel.ts

@@ -0,0 +1,87 @@
+import { Ingress } from './ingress.js';
+
+export class Tunnel {
+  constructor(
+    public name: string,
+    public id?: string,
+    public credentialsPath?: string,
+    public ingress: Ingress[] = [],
+    public catchAll: string = 'http_status:404',
+  ) {}
+
+  addIngress(hostname: string | undefined, service: string): void {
+    if (!hostname) return;
+    const existing = this.ingress.findIndex(
+      (e) => e.hostname === hostname,
+    );
+    if (existing !== -1) {
+      this.ingress[existing].service = service;
+    } else {
+      this.ingress.push({ hostname, service });
+    }
+  }
+
+  removeIngress(hostname: string): void {
+    this.ingress = this.ingress.filter((e) => e.hostname !== hostname);
+  }
+
+  toYaml(): string {
+    const lines: string[] = [];
+    if (this.id) {
+      lines.push(`tunnel: ${this.id}`);
+    }
+    if (this.credentialsPath) {
+      lines.push(`credentials-file: ${this.credentialsPath}`);
+    }
+    lines.push('');
+    lines.push('ingress:');
+
+    const sorted = [...this.ingress].sort((a, b) => {
+      const ha = a.hostname ?? '';
+      const hb = b.hostname ?? '';
+      return ha.localeCompare(hb);
+    });
+
+    for (const entry of sorted) {
+      if (entry.hostname) {
+        lines.push(`  - hostname: ${entry.hostname}`);
+        lines.push(`    service: ${entry.service}`);
+      }
+    }
+    lines.push(`  - service: ${this.catchAll}`);
+    lines.push('');
+
+    return lines.join('\n');
+  }
+
+  static fromYaml(content: string): Tunnel {
+    const tunnel = new Tunnel('');
+    const lines = content.split('\n');
+
+    let inIngress = false;
+
+    for (const raw of lines) {
+      const line = raw.trimEnd();
+      const trimmed = line.trimStart();
+      if (line.startsWith('tunnel: ')) {
+        tunnel.id = line.slice('tunnel: '.length);
+      } else if (line.startsWith('credentials-file: ')) {
+        tunnel.credentialsPath = line.slice('credentials-file: '.length);
+      } else if (trimmed === 'ingress:') {
+        inIngress = true;
+      } else if (inIngress && trimmed.startsWith('- hostname: ')) {
+        const hostname = trimmed.slice('- hostname: '.length);
+        tunnel.ingress.push({ hostname, service: '' });
+      } else if (inIngress && trimmed.startsWith('service: ') && tunnel.ingress.length > 0) {
+        const last = tunnel.ingress[tunnel.ingress.length - 1];
+        if (last.service === '') {
+          last.service = trimmed.slice('service: '.length);
+        }
+      } else if (inIngress && trimmed.startsWith('- service: ')) {
+        tunnel.catchAll = trimmed.slice('- service: '.length);
+      }
+    }
+
+    return tunnel;
+  }
+}

src/services/cloudflare.orchestrator.ts

@@ -1,7 +1,7 @@
 import type { ShipnodeConfig } from '../shared/types.js';
 import type { RemoteExecutor } from '../domain/remote/executor.js';
 import { CloudflareApi } from '../infrastructure/cloudflare/api.js';
-import { getWebApp } from '../domain/pm2/apps.js';
+import { Tunnel } from '../domain/cloudflare/tunnel.js';
 
 export class CloudflareOrchestrator {
   private api: CloudflareApi;
@@ -19,21 +19,27 @@ export class CloudflareOrchestrator {
     if (!cf) throw new Error('No cloudflare config found.');
 
     await this.ensureCloudflaredInstalled();
-
     const tunnelName = cf.tunnelName ?? `shipnode-${this.config.ssh.host.replace(/\./g, '-')}`;
 
     await this.executor.exec(`cloudflared tunnel create "${tunnelName}" 2>&1`);
     const tunnelId = await this.resolveTunnelId();
 
-    if (cf.appHostname) {
-      await this.executor.exec(`cloudflared tunnel route dns "${tunnelName}" "${cf.appHostname}"`);
+    const tunnel = new Tunnel(tunnelName, tunnelId, `/root/.cloudflared/${tunnelId}.json`);
+
+    for (const app of this.config.apps) {
+      const webApp = app.pm2?.apps.find((a) => a.port !== undefined);
+      if (app.domain && webApp) {
+        tunnel.addIngress(app.domain, `http://localhost:${webApp.port}`);
+        await this.executor.exec(`cloudflared tunnel route dns "${tunnelName}" "${app.domain}"`);
+      }
     }
 
     if (cf.sshHostname) {
+      tunnel.addIngress(cf.sshHostname, 'ssh://localhost:22');
       await this.executor.exec(`cloudflared tunnel route dns "${tunnelName}" "${cf.sshHostname}"`);
     }
 
-    await this.writeTunnelConfig(tunnelId, cf);
+    await this.writeConfig(tunnel);
     await this.installAndStartService();
 
     if (cf.lockdownFirewall) {
@@ -45,18 +51,19 @@ export class CloudflareOrchestrator {
     }
   }
 
-  async audit(): Promise<{ zone: { name: string; id: string; status: string }; dns: string; tunnelList: string; service: string }> {
+  async audit(): Promise<{ zone: { name: string; id: string; status: string }; apps: { domain: string; port: number | undefined }[]; tunnelList: string; service: string }> {
     const cf = this.config.cloudflare;
     if (!cf) throw new Error('No cloudflare config found.');
 
     const zoneId = await this.api.getZoneId(cf.zone);
     const zoneInfo = await this.api.fetch<{ id: string; name: string; status: string }>(`/zones/${zoneId}`);
 
-    let dns = '';
-    if (cf.appHostname) {
-      const records = await this.api.getDnsRecords(zoneId, cf.appHostname);
-      dns = records.length ? `${records[0].type} → ${records[0].content}` : 'NOT FOUND';
-    }
+    const apps = this.config.apps
+      .map((a) => {
+        const web = a.pm2?.apps.find((p) => p.port !== undefined);
+        return web && a.domain ? { domain: a.domain, port: web.port } : null;
+      })
+      .filter((x): x is NonNullable<typeof x> => x !== null);
 
     const tunnelResult = await this.executor.exec('cloudflared tunnel list 2>/dev/null || echo MISSING');
     const tunnelList = tunnelResult.stdout.includes('MISSING') ? 'not installed' : tunnelResult.stdout.trim();
@@ -65,7 +72,7 @@ export class CloudflareOrchestrator {
 
     return {
       zone: { name: zoneInfo.name, id: zoneInfo.id, status: zoneInfo.status },
-      dns,
+      apps,
       tunnelList,
       service: svcResult.stdout.trim(),
     };
@@ -100,28 +107,9 @@ export class CloudflareOrchestrator {
     return tunnelId;
   }
 
-  private async writeTunnelConfig(tunnelId: string, cf: NonNullable<ShipnodeConfig['cloudflare']>): Promise<void> {
-    const webApp = getWebApp(this.config);
-    if (cf.appHostname && !webApp) {
-      throw new Error('cloudflare.appHostname is set but no pm2.apps entry declares a port — nothing to route HTTP to.');
-    }
-    const appIngress = cf.appHostname && webApp
-      ? `  - hostname: ${cf.appHostname}\n    service: http://localhost:${webApp.port}`
-      : '';
-    const sshIngress = cf.sshHostname
-      ? `  - hostname: ${cf.sshHostname}\n    service: ssh://localhost:22`
-      : '';
-
-    const cfConfig = `tunnel: ${tunnelId}
-credentials-file: /root/.cloudflared/${tunnelId}.json
-
-ingress:
-${appIngress}
-${sshIngress}
-  - service: http_status:404
-`;
-
-    const b64 = Buffer.from(cfConfig).toString('base64');
+  private async writeConfig(tunnel: Tunnel): Promise<void> {
+    const yaml = tunnel.toYaml();
+    const b64 = Buffer.from(yaml).toString('base64');
     await this.executor.exec(
       `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; ` +
       `mkdir -p /etc/cloudflared && ` +
@@ -137,19 +125,25 @@ ${sshIngress}
   }
 
   private async lockdownFirewall(): Promise<void> {
-    const webApp = getWebApp(this.config);
-    if (!webApp) return;
+    const webPorts = this.config.apps
+      .flatMap((a) => a.pm2?.apps ?? [])
+      .filter((a) => a.port !== undefined)
+      .map((a) => a.port!);
+
+    if (!webPorts.length) return;
 
     const cfIps = await this.api.getCloudflareIps();
-    for (const cidr of cfIps.ipv4_cidrs ?? []) {
+    for (const port of webPorts) {
+      for (const cidr of cfIps.ipv4_cidrs ?? []) {
+        await this.executor.exec(
+          `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; ` +
+          `$SUDO ufw allow from ${cidr} to any port ${port} 2>/dev/null || true`,
+        );
+      }
       await this.executor.exec(
         `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; ` +
-        `$SUDO ufw allow from ${cidr} to any port ${webApp.port} 2>/dev/null || true`,
+        `$SUDO ufw deny ${port} 2>/dev/null || true`,
       );
     }
-    await this.executor.exec(
-      `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; ` +
-      `$SUDO ufw deny ${webApp.port} 2>/dev/null || true`,
-    );
   }
 }

src/shared/types.ts

@@ -66,7 +66,6 @@ export interface BackupConfig {
 
 export interface CloudflareConfig {
   zone: string;
-  appHostname?: string;
   sshHostname?: string;
   tunnelName?: string;
   lockdownFirewall?: boolean;

tests/unit/builder.test.ts

@@ -29,7 +29,7 @@ describe('ShipnodeBuilder', () => {
       .database({ type: 'postgres', host: 'localhost', port: 5432, name: 'db', user: 'u', password: 'p' })
       .redis({ host: 'localhost', port: 6379, password: 'rp' })
       .backup({ s3Bucket: 'backups', s3Prefix: 'prod', schedule: 'daily', retentionDays: 30 })
-      .cloudflare({ zone: 'example.com', appHostname: 'api.example.com', tunnelName: 't', lockdownFirewall: true })
+      .cloudflare({ zone: 'example.com', tunnelName: 't', lockdownFirewall: true })
       .preDeploy(preDeploy)
       .postDeploy(postDeploy)
       .aliases({ migrate: 'pnpm db:apply', seed: 'pnpm db:seed' })
@@ -55,7 +55,7 @@ describe('ShipnodeBuilder', () => {
     expect(config.database).toMatchObject({ type: 'postgres', host: 'localhost', port: 5432, name: 'db', user: 'u', password: 'p' });
     expect(config.redis).toEqual({ host: 'localhost', port: 6379, password: 'rp' });
     expect(config.backup).toMatchObject({ s3Bucket: 'backups', s3Prefix: 'prod', schedule: 'daily', retentionDays: 30 });
-    expect(config.cloudflare).toMatchObject({ zone: 'example.com', appHostname: 'api.example.com', tunnelName: 't', lockdownFirewall: true });
+    expect(config.cloudflare).toMatchObject({ zone: 'example.com', tunnelName: 't', lockdownFirewall: true });
     expect(config.apps[0].hooks?.preDeploy).toBe(preDeploy);
     expect(config.apps[0].hooks?.postDeploy).toBe(postDeploy);
     expect(config.aliases).toEqual({ migrate: 'pnpm db:apply', seed: 'pnpm db:seed' });
@@ -316,11 +316,10 @@ describe('ShipnodeBuilder', () => {
       .backend()
       .ssh({ host: '1.2.3.4', user: 'deploy' })
       .deployTo('/var/www/app')
-      .cloudflare({ zone: 'example.com', appHostname: 'app.example.com', lockdownFirewall: true })
+      .cloudflare({ zone: 'example.com', tunnelName: 'app', lockdownFirewall: true })
       .build();
 
     expect(config.cloudflare?.zone).toBe('example.com');
-    expect(config.cloudflare?.appHostname).toBe('app.example.com');
     expect(config.cloudflare?.lockdownFirewall).toBe(true);
   });
 });

tests/unit/cloudflare.tunnel.test.ts

@@ -0,0 +1,80 @@
+import { describe, it, expect } from 'vitest';
+import { Tunnel } from '../../src/domain/cloudflare/tunnel.js';
+
+const sampleYaml = `tunnel: abc123
+credentials-file: /root/.cloudflared/abc123.json
+
+ingress:
+  - hostname: api.example.com
+    service: http://localhost:3000
+  - hostname: ssh.example.com
+    service: ssh://localhost:22
+  - service: http_status:404
+`;
+
+describe('Tunnel', () => {
+  it('round-trips YAML', () => {
+    const tunnel = Tunnel.fromYaml(sampleYaml);
+    expect(tunnel.id).toBe('abc123');
+    expect(tunnel.credentialsPath).toBe('/root/.cloudflared/abc123.json');
+    expect(tunnel.ingress).toHaveLength(2);
+    expect(tunnel.ingress[0]).toEqual({ hostname: 'api.example.com', service: 'http://localhost:3000' });
+    expect(tunnel.ingress[1]).toEqual({ hostname: 'ssh.example.com', service: 'ssh://localhost:22' });
+    expect(tunnel.catchAll).toBe('http_status:404');
+
+    const output = tunnel.toYaml();
+    expect(output).toBe(sampleYaml);
+  });
+
+  it('adds an ingress entry', () => {
+    const tunnel = Tunnel.fromYaml(sampleYaml);
+    tunnel.addIngress('admin.example.com', 'http://localhost:4000');
+    expect(tunnel.ingress).toHaveLength(3);
+  });
+
+  it('replaces an existing ingress entry by hostname', () => {
+    const tunnel = Tunnel.fromYaml(sampleYaml);
+    tunnel.addIngress('api.example.com', 'http://localhost:5000');
+    expect(tunnel.ingress).toHaveLength(2);
+    const api = tunnel.ingress.find((i) => i.hostname === 'api.example.com');
+    expect(api?.service).toBe('http://localhost:5000');
+  });
+
+  it('skips addIngress when hostname is empty', () => {
+    const tunnel = Tunnel.fromYaml(sampleYaml);
+    tunnel.addIngress(undefined, 'http://localhost:4000');
+    expect(tunnel.ingress).toHaveLength(2);
+  });
+
+  it('removes an ingress entry', () => {
+    const tunnel = Tunnel.fromYaml(sampleYaml);
+    tunnel.removeIngress('ssh.example.com');
+    expect(tunnel.ingress).toHaveLength(1);
+    expect(tunnel.ingress[0].hostname).toBe('api.example.com');
+  });
+
+  it('sorts ingress entries by hostname', () => {
+    const tunnel = new Tunnel('test', 'abc', '/creds');
+    tunnel.addIngress('z.example.com', 'http://localhost:3000');
+    tunnel.addIngress('a.example.com', 'http://localhost:4000');
+    tunnel.addIngress('m.example.com', 'http://localhost:5000');
+
+    const yaml = tunnel.toYaml();
+    const lines = yaml.split('\n');
+    const hostnameLines = lines.filter((l) => l.startsWith('  - hostname:'));
+    expect(hostnameLines[0]).toContain('a.example.com');
+    expect(hostnameLines[1]).toContain('m.example.com');
+    expect(hostnameLines[2]).toContain('z.example.com');
+  });
+
+  it('serializes without id or credentials', () => {
+    const tunnel = new Tunnel('test');
+    tunnel.addIngress('app.example.com', 'http://localhost:8080');
+
+    const yaml = tunnel.toYaml();
+    expect(yaml).not.toContain('tunnel:');
+    expect(yaml).not.toContain('credentials-file:');
+    expect(yaml).toContain('app.example.com');
+    expect(yaml).toContain('http_status:404');
+  });
+});