fix: reuse host Cloudflare tunnel and keep Caddy ingress for blue-green.

Prevent cloudflare init from minting a mismatched tunnel id/credentials pair, merge existing ingress (including originRequest), route zero-downtime apps through local Caddy, and bump to 3.2.0-alpha.6.

Author: devalade

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devalade/shipnode",
-  "version": "3.2.0-alpha.5",
+  "version": "3.2.0-alpha.6",
   "description": "Deploy Node.js apps to a single VPS with zero configuration",
   "type": "module",
   "main": "dist/index.js",

src/domain/cloudflare/ingress.ts

@@ -1,4 +1,11 @@
+export interface IngressOriginRequest {
+  noTLSVerify?: boolean;
+  originServerName?: string;
+  httpHostHeader?: string;
+}
+
 export interface Ingress {
   hostname?: string;
   service: string;
+  originRequest?: IngressOriginRequest;
 }

src/domain/cloudflare/tunnel.ts

@@ -1,4 +1,4 @@
-import { Ingress } from './ingress.js';
+import { Ingress, type IngressOriginRequest } from './ingress.js';
 
 export class Tunnel {
   constructor(
@@ -9,15 +9,21 @@ export class Tunnel {
     public catchAll: string = 'http_status:404',
   ) {}
 
-  addIngress(hostname: string | undefined, service: string): void {
+  addIngress(
+    hostname: string | undefined,
+    service: string,
+    originRequest?: IngressOriginRequest,
+  ): void {
     if (!hostname) return;
     const existing = this.ingress.findIndex(
       (e) => e.hostname === hostname,
     );
+    const entry: Ingress = { hostname, service };
+    if (originRequest) entry.originRequest = originRequest;
     if (existing !== -1) {
-      this.ingress[existing].service = service;
+      this.ingress[existing] = entry;
     } else {
-      this.ingress.push({ hostname, service });
+      this.ingress.push(entry);
     }
   }
 
@@ -46,6 +52,18 @@ export class Tunnel {
       if (entry.hostname) {
         lines.push(`  - hostname: ${entry.hostname}`);
         lines.push(`    service: ${entry.service}`);
+        if (entry.originRequest) {
+          lines.push(`    originRequest:`);
+          if (entry.originRequest.noTLSVerify) {
+            lines.push(`      noTLSVerify: true`);
+          }
+          if (entry.originRequest.originServerName) {
+            lines.push(`      originServerName: ${entry.originRequest.originServerName}`);
+          }
+          if (entry.originRequest.httpHostHeader) {
+            lines.push(`      httpHostHeader: ${entry.originRequest.httpHostHeader}`);
+          }
+        }
       }
     }
     lines.push(`  - service: ${this.catchAll}`);
@@ -59,25 +77,51 @@ export class Tunnel {
     const lines = content.split('\n');
 
     let inIngress = false;
+    let inOriginRequest = false;
 
     for (const raw of lines) {
       const line = raw.trimEnd();
       const trimmed = line.trimStart();
       if (line.startsWith('tunnel: ')) {
         tunnel.id = line.slice('tunnel: '.length);
+        inOriginRequest = false;
       } else if (line.startsWith('credentials-file: ')) {
         tunnel.credentialsPath = line.slice('credentials-file: '.length);
+        inOriginRequest = false;
       } else if (trimmed === 'ingress:') {
         inIngress = true;
+        inOriginRequest = false;
       } else if (inIngress && trimmed.startsWith('- hostname: ')) {
+        inOriginRequest = false;
         const hostname = trimmed.slice('- hostname: '.length);
         tunnel.ingress.push({ hostname, service: '' });
+      } else if (inIngress && trimmed === 'originRequest:') {
+        inOriginRequest = true;
+        const last = tunnel.ingress[tunnel.ingress.length - 1];
+        if (last) last.originRequest = {};
+      } else if (inIngress && inOriginRequest && trimmed.startsWith('noTLSVerify:')) {
+        const last = tunnel.ingress[tunnel.ingress.length - 1];
+        if (last?.originRequest) {
+          last.originRequest.noTLSVerify = trimmed.includes('true');
+        }
+      } else if (inIngress && inOriginRequest && trimmed.startsWith('originServerName: ')) {
+        const last = tunnel.ingress[tunnel.ingress.length - 1];
+        if (last?.originRequest) {
+          last.originRequest.originServerName = trimmed.slice('originServerName: '.length);
+        }
+      } else if (inIngress && inOriginRequest && trimmed.startsWith('httpHostHeader: ')) {
+        const last = tunnel.ingress[tunnel.ingress.length - 1];
+        if (last?.originRequest) {
+          last.originRequest.httpHostHeader = trimmed.slice('httpHostHeader: '.length);
+        }
       } else if (inIngress && trimmed.startsWith('service: ') && tunnel.ingress.length > 0) {
+        inOriginRequest = false;
         const last = tunnel.ingress[tunnel.ingress.length - 1];
         if (last.service === '') {
           last.service = trimmed.slice('service: '.length);
         }
       } else if (inIngress && trimmed.startsWith('- service: ')) {
+        inOriginRequest = false;
         tunnel.catchAll = trimmed.slice('- service: '.length);
       }
     }

src/services/cloudflare.orchestrator.ts

@@ -27,38 +27,55 @@ export class CloudflareOrchestrator {
     const zoneId = await this.api.getZoneId(cf.zone);
     const tunnelName = cf.tunnelName ?? `shipnode-${this.config.ssh.host.replace(/\./g, '-')}`;
 
-    // Reuse an existing tunnel by name if present. We can only mint credentials
-    // when we create the tunnel (Cloudflare doesn't echo the secret again), so
-    // if it already exists we assume credentials are already on the host and
-    // just refresh config + DNS. A brand-new host reusing an old tunnel name
-    // will need `cloudflared tunnel delete` first — flagged loudly.
-    const existing = await this.api.findTunnel(accountId, tunnelName);
+    // Prefer the tunnel already running on this host. Creating a new tunnel (or
+    // picking a same-named API tunnel) while leaving the old credentials path
+    // in config.yml produces a silent id/creds mismatch and takes every app
+    // offline. Only mint a new tunnel when the host has no usable config.
+    const hostTunnel = await this.readHostTunnel();
     let tunnelId: string;
-    if (existing) {
-      tunnelId = existing.id;
-      const credsExists = await this.executor.exec(
-        `test -f "/etc/cloudflared/${tunnelId}.json" && echo YES || echo NO`,
+    let tunnel: Tunnel;
+
+    if (hostTunnel?.id && hostTunnel.credentialsPath) {
+      const credsOk = await this.executor.exec(
+        `test -f "${hostTunnel.credentialsPath}" && echo YES || echo NO`,
       );
-      if (credsExists.stdout.trim() !== 'YES') {
+      if (credsOk.stdout.trim() !== 'YES') {
         throw new Error(
-          `Tunnel "${tunnelName}" already exists (id ${tunnelId}) but its credentials file is not on this host. ` +
-          `Delete the tunnel in the Cloudflare dashboard (or via API) and re-run \`shipnode cloudflare init\`, ` +
-          `or copy /etc/cloudflared/${tunnelId}.json from the host that owns it.`,
+          `Host config references tunnel ${hostTunnel.id} but credentials ` +
+          `${hostTunnel.credentialsPath} are missing. Restore the credentials ` +
+          `file or delete /etc/cloudflared/config.yml and re-run init.`,
         );
       }
+      tunnelId = hostTunnel.id;
+      tunnel = hostTunnel;
+      tunnel.name = tunnelName;
     } else {
-      const secret = randomBytes(32).toString('base64');
-      const created: CfTunnel = await this.api.createTunnel(accountId, tunnelName, secret);
-      tunnelId = created.id;
-      await this.writeCredentials(tunnelId, tunnelName, accountId, secret);
+      const existing = await this.api.findTunnel(accountId, tunnelName);
+      if (existing) {
+        tunnelId = existing.id;
+        const credsExists = await this.executor.exec(
+          `test -f "/etc/cloudflared/${tunnelId}.json" && echo YES || echo NO`,
+        );
+        if (credsExists.stdout.trim() !== 'YES') {
+          throw new Error(
+            `Tunnel "${tunnelName}" already exists (id ${tunnelId}) but its credentials file is not on this host. ` +
+            `Delete the tunnel in the Cloudflare dashboard (or via API) and re-run \`shipnode cloudflare init\`, ` +
+            `or copy /etc/cloudflared/${tunnelId}.json from the host that owns it.`,
+          );
+        }
+      } else {
+        const secret = randomBytes(32).toString('base64');
+        const created: CfTunnel = await this.api.createTunnel(accountId, tunnelName, secret);
+        tunnelId = created.id;
+        await this.writeCredentials(tunnelId, tunnelName, accountId, secret);
+      }
+      tunnel = new Tunnel(tunnelName, tunnelId, `/etc/cloudflared/${tunnelId}.json`);
     }
 
-    const tunnel = new Tunnel(tunnelName, tunnelId, `/etc/cloudflared/${tunnelId}.json`);
-
     for (const app of this.config.apps) {
       const webApp = app.pm2?.apps.find((a) => a.port !== undefined);
       if (app.domain && webApp) {
-        tunnel.addIngress(app.domain, `http://localhost:${webApp.port}`);
+        this.addAppIngress(tunnel, app.domain, webApp.port!, Boolean(app.zeroDowntime));
         await this.api.upsertDnsRecord(zoneId, {
           type: 'CNAME',
           name: app.domain,
@@ -78,6 +95,10 @@ export class CloudflareOrchestrator {
       });
     }
 
+    // Credentials path must always match the tunnel id we advertise in DNS.
+    tunnel.id = tunnelId;
+    tunnel.credentialsPath = `/etc/cloudflared/${tunnelId}.json`;
+
     await this.writeConfig(tunnel);
     await this.installAndStartService();
 
@@ -183,12 +204,44 @@ export class CloudflareOrchestrator {
     );
   }
 
+  /**
+   * Blue-green apps flip Caddy's upstream between colours. Pointing the tunnel
+   * at a fixed app port would pin traffic to one colour and break rollouts.
+   * Route those hostnames through local Caddy (TLS) with the public Host header.
+   */
+  private addAppIngress(
+    tunnel: Tunnel,
+    domain: string,
+    port: number,
+    zeroDowntime: boolean,
+  ): void {
+    if (zeroDowntime) {
+      tunnel.addIngress(domain, 'https://localhost:443', {
+        noTLSVerify: true,
+        originServerName: domain,
+        httpHostHeader: domain,
+      });
+      return;
+    }
+    tunnel.addIngress(domain, `http://localhost:${port}`);
+  }
+
+  private async readHostTunnel(): Promise<Tunnel | null> {
+    const existing = await this.executor.exec(
+      `cat /etc/cloudflared/config.yml 2>/dev/null || echo ""`,
+    );
+    const yaml = existing.stdout.trim();
+    if (!yaml) return null;
+    return Tunnel.fromYaml(yaml);
+  }
+
   private async writeConfig(tunnel: Tunnel): Promise<void> {
     const yaml = tunnel.toYaml();
     const b64 = Buffer.from(yaml).toString('base64');
     await this.executor.execOrThrow(
       `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; ` +
       `$SUDO mkdir -p /etc/cloudflared && ` +
+      `$SUDO cp /etc/cloudflared/config.yml "/etc/cloudflared/config.yml.bak.$(date +%Y%m%d%H%M%S)" 2>/dev/null || true; ` +
       `printf '%s' '${b64}' | base64 -d | $SUDO tee /etc/cloudflared/config.yml > /dev/null`,
     );
   }
@@ -206,6 +259,11 @@ export class CloudflareOrchestrator {
     await this.executor.execOrThrow(
       `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; ` +
       `$SUDO systemctl enable cloudflared 2>/dev/null; ` +
+      // Type=notify + fresh QUIC handshake can exceed the default 15s start
+      // timeout on a busy host; bump before restart so init doesn't false-fail.
+      `$SUDO mkdir -p /etc/systemd/system/cloudflared.service.d && ` +
+      `printf '%s\n' '[Service]' 'TimeoutStartSec=60' | $SUDO tee /etc/systemd/system/cloudflared.service.d/timeout.conf > /dev/null && ` +
+      `$SUDO systemctl daemon-reload && ` +
       `$SUDO systemctl restart cloudflared`,
     );
   }

tests/unit/cloudflare.tunnel.test.ts

@@ -12,6 +12,19 @@ ingress:
   - service: http_status:404
 `;
 
+const caddyYaml = `tunnel: abc123
+credentials-file: /etc/cloudflared/abc123.json
+
+ingress:
+  - hostname: app.example.com
+    service: https://localhost:443
+    originRequest:
+      noTLSVerify: true
+      originServerName: app.example.com
+      httpHostHeader: app.example.com
+  - service: http_status:404
+`;
+
 describe('Tunnel', () => {
   it('round-trips YAML', () => {
     const tunnel = Tunnel.fromYaml(sampleYaml);
@@ -26,6 +39,21 @@ describe('Tunnel', () => {
     expect(output).toBe(sampleYaml);
   });
 
+  it('round-trips Caddy-fronted originRequest blocks', () => {
+    const tunnel = Tunnel.fromYaml(caddyYaml);
+    expect(tunnel.ingress).toHaveLength(1);
+    expect(tunnel.ingress[0]).toEqual({
+      hostname: 'app.example.com',
+      service: 'https://localhost:443',
+      originRequest: {
+        noTLSVerify: true,
+        originServerName: 'app.example.com',
+        httpHostHeader: 'app.example.com',
+      },
+    });
+    expect(tunnel.toYaml()).toBe(caddyYaml);
+  });
+
   it('adds an ingress entry', () => {
     const tunnel = Tunnel.fromYaml(sampleYaml);
     tunnel.addIngress('admin.example.com', 'http://localhost:4000');