homeio

1import "server-only";
2
3import { logServerAction } from "@/lib/server/logging/logger";
4
5const API_BASE = "https://api.cloudflare.com/client/v4";
6
7type IngressRule = {
8  hostname?: string;
9  service: string;
10  originRequest?: Record<string, unknown>;
11  path?: string;
12};
13
14type TunnelConfiguration = {
15  ingress: IngressRule[];
16  [key: string]: unknown;
17};
18
19/**
20 * The connector token is base64 of {"a": account tag, "t": tunnel id, "s": secret}.
21 * Reading it means the operator supplies one token, not three identifiers.
22 */
23export function decodeConnectorToken(token: string) {
24  try {
25    const decoded = JSON.parse(Buffer.from(token.trim(), "base64").toString("utf8")) as {
26      a?: unknown;
27      t?: unknown;
28    };
29
30    if (typeof decoded.a !== "string" || typeof decoded.t !== "string") return null;
31    return { accountId: decoded.a, tunnelId: decoded.t };
32  } catch {
33    return null;
34  }
35}
36
37/**
38 * Cloudflare hands out the whole install command, not the bare token:
39 *
40 *   sudo cloudflared service install eyJhIjoi...
41 *   docker run cloudflare/cloudflared:latest tunnel run --token eyJhIjoi...
42 *
43 * Pull the token out of whatever was pasted, so copying the command as shown
44 * works. Anything with no usable token is returned untouched for validation
45 * to reject with a message.
46 */
47export function normalizeConnectorToken(input: string) {
48  const trimmed = input.trim();
49
50  for (const candidate of trimmed.match(/eyJ[A-Za-z0-9+/=_-]+/g) ?? []) {
51    if (decodeConnectorToken(candidate)) return candidate;
52  }
53
54  return trimmed;
55}
56
57async function cloudflareRequest<T>(input: {
58  apiToken: string;
59  path: string;
60  method?: string;
61  body?: unknown;
62}): Promise<T> {
63  const response = await fetch(`${API_BASE}${input.path}`, {
64    method: input.method ?? "GET",
65    headers: {
66      Authorization: `Bearer ${input.apiToken}`,
67      "Content-Type": "application/json",
68    },
69    body: input.body === undefined ? undefined : JSON.stringify(input.body),
70  });
71
72  const payload = (await response.json().catch(() => null)) as {
73    success?: boolean;
74    result?: T;
75    errors?: { message?: string }[];
76  } | null;
77
78  if (!response.ok || !payload?.success) {
79    const detail =
80      payload?.errors?.map((error) => error.message).filter(Boolean).join("; ") ||
81      `HTTP ${response.status}`;
82    throw new Error(`Cloudflare API: ${detail}`);
83  }
84
85  return payload.result as T;
86}
87
88/**
89 * Ask Cloudflare whether the API token is real and active. Pasting the wrong
90 * secret into the wrong field is easy, and the failure is otherwise silent:
91 * everything saves, and nothing happens until someone reads a log.
92 */
93export async function verifyApiToken(apiToken: string) {
94  const result = await cloudflareRequest<{ status?: string }>({
95    apiToken,
96    path: "/user/tokens/verify",
97  });
98
99  if (result?.status && result.status !== "active") {
100    throw new Error(`Cloudflare API token is ${result.status}`);
101  }
102}
103
104async function resolveZoneId(apiToken: string, domain: string) {
105  const zones = await cloudflareRequest<{ id: string; name: string }[]>({
106    apiToken,
107    path: `/zones?name=${encodeURIComponent(domain)}`,
108  });
109
110  const zone = zones?.[0];
111  if (!zone) {
112    throw new Error(`No Cloudflare zone found for ${domain}`);
113  }
114
115  return zone.id;
116}
117
118async function getTunnelConfiguration(input: {
119  apiToken: string;
120  accountId: string;
121  tunnelId: string;
122}) {
123  const result = await cloudflareRequest<{ config?: TunnelConfiguration }>({
124    apiToken: input.apiToken,
125    path: `/accounts/${input.accountId}/cfd_tunnel/${input.tunnelId}/configurations`,
126  });
127
128  return result?.config ?? { ingress: [] };
129}
130
131async function putTunnelConfiguration(input: {
132  apiToken: string;
133  accountId: string;
134  tunnelId: string;
135  config: TunnelConfiguration;
136}) {
137  await cloudflareRequest({
138    apiToken: input.apiToken,
139    path: `/accounts/${input.accountId}/cfd_tunnel/${input.tunnelId}/configurations`,
140    method: "PUT",
141    body: { config: input.config },
142  });
143}
144
145/** The catch-all has no hostname and must stay last, so it is rebuilt each time. */
146function withCatchAllLast(rules: IngressRule[]) {
147  const routed = rules.filter((rule) => Boolean(rule.hostname));
148  const catchAll = rules.find((rule) => !rule.hostname) ?? { service: "http_status:404" };
149  return [...routed, catchAll];
150}
151
152export type CloudflareRouteInput = {
153  apiToken: string;
154  accountId: string;
155  tunnelId: string;
156  domain: string;
157  hostname: string;
158  /** Where the tunnel should send traffic, e.g. http://localhost:8080 */
159  service: string;
160};
161
162/** Add (or update) the public hostname and the CNAME that points at the tunnel. */
163export async function createTunnelRoute(input: CloudflareRouteInput) {
164  const config = await getTunnelConfiguration(input);
165  const others = (config.ingress ?? []).filter((rule) => rule.hostname !== input.hostname);
166
167  await putTunnelConfiguration({
168    ...input,
169    config: {
170      ...config,
171      ingress: withCatchAllLast([
172        ...others,
173        { hostname: input.hostname, service: input.service },
174      ]),
175    },
176  });
177
178  const zoneId = await resolveZoneId(input.apiToken, input.domain);
179  const existing = await cloudflareRequest<{ id: string }[]>({
180    apiToken: input.apiToken,
181    path: `/zones/${zoneId}/dns_records?name=${encodeURIComponent(input.hostname)}&type=CNAME`,
182  });
183
184  const record = {
185    type: "CNAME",
186    name: input.hostname,
187    content: `${input.tunnelId}.cfargotunnel.com`,
188    proxied: true,
189  };
190
191  if (existing?.[0]) {
192    await cloudflareRequest({
193      apiToken: input.apiToken,
194      path: `/zones/${zoneId}/dns_records/${existing[0].id}`,
195      method: "PATCH",
196      body: record,
197    });
198  } else {
199    await cloudflareRequest({
200      apiToken: input.apiToken,
201      path: `/zones/${zoneId}/dns_records`,
202      method: "POST",
203      body: record,
204    });
205  }
206
207  logServerAction({
208    level: "info",
209    layer: "service",
210    action: "cloudflare.route.create",
211    status: "success",
212    message: `Published ${input.hostname}`,
213  });
214}
215
216/** Remove the ingress rule and the CNAME again. */
217export async function deleteTunnelRoute(input: Omit<CloudflareRouteInput, "service">) {
218  const config = await getTunnelConfiguration(input);
219  const remaining = (config.ingress ?? []).filter((rule) => rule.hostname !== input.hostname);
220
221  await putTunnelConfiguration({
222    ...input,
223    config: { ...config, ingress: withCatchAllLast(remaining) },
224  });
225
226  const zoneId = await resolveZoneId(input.apiToken, input.domain);
227  const existing = await cloudflareRequest<{ id: string; content: string }[]>({
228    apiToken: input.apiToken,
229    path: `/zones/${zoneId}/dns_records?name=${encodeURIComponent(input.hostname)}&type=CNAME`,
230  });
231
232  for (const record of existing ?? []) {
233    // Only reclaim records that point at this tunnel: the operator may have
234    // pointed that name somewhere else by hand.
235    if (record.content !== `${input.tunnelId}.cfargotunnel.com`) continue;
236    await cloudflareRequest({
237      apiToken: input.apiToken,
238      path: `/zones/${zoneId}/dns_records/${record.id}`,
239      method: "DELETE",
240    });
241  }
242
243  logServerAction({
244    level: "info",
245    layer: "service",
246    action: "cloudflare.route.delete",
247    status: "success",
248    message: `Unpublished ${input.hostname}`,
249  });
250}
251