Cloudflare Tunnel Publish

"""Cloudflare API helpers — shared by verify.py / setup.py / teardown.py.

Uses the user's CLOUDFLARE_API_TOKEN from workspace/.env. All calls go direct
to api.cloudflare.com (Cloudflare's own endpoint, not via sc-proxy — this is
the user's own credential, not a platform-billed API).
"""
from __future__ import annotations

import json
import os
import sys
from pathlib import Path
from typing import Any

import urllib.request
import urllib.error

WORKSPACE = Path("/data/workspace")
STATE_PATH = WORKSPACE / ".cf_state.json"
ENV_PATH = WORKSPACE / ".env"
API_BASE = "https://api.cloudflare.com/client/v4"


def _load_env() -> None:
    """Load workspace/.env into os.environ (very small parser)."""
    if not ENV_PATH.exists():
        return
    for line in ENV_PATH.read_text().splitlines():
        line = line.strip()
        if not line or line.startswith("#") or "=" not in line:
            continue
        k, _, v = line.partition("=")
        k = k.strip()
        v = v.strip().strip('"').strip("'")
        os.environ.setdefault(k, v)


def get_token() -> str:
    _load_env()
    tok = os.environ.get("CLOUDFLARE_API_TOKEN", "").strip()
    if not tok:
        print("ERROR: CLOUDFLARE_API_TOKEN not set in workspace/.env", file=sys.stderr)
        sys.exit(2)
    return tok


def cf_request(method: str, path: str, body: dict | None = None) -> dict[str, Any]:
    """Call Cloudflare API. Returns parsed JSON. Raises on HTTP error."""
    token = get_token()
    url = f"{API_BASE}{path}"
    data = json.dumps(body).encode() if body is not None else None
    req = urllib.request.Request(url, data=data, method=method)
    req.add_header("Authorization", f"Bearer {token}")
    req.add_header("Content-Type", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        body_text = e.read().decode(errors="replace")
        print(f"HTTP {e.code} on {method} {path}\n{body_text}", file=sys.stderr)
        raise


def load_state() -> dict[str, Any]:
    if STATE_PATH.exists():
        return json.loads(STATE_PATH.read_text())
    return {}


def save_state(state: dict[str, Any]) -> None:
    STATE_PATH.write_text(json.dumps(state, indent=2))


def update_state(**kwargs) -> dict[str, Any]:
    s = load_state()
    s.update(kwargs)
    save_state(s)
    return s

"""End-to-end status check after setup. Tells the user EXACTLY which stage
is still pending: DNS propagation, SSL cert provisioning, or service-side.

Run anytime after setup.py to see current state without bothering the user.
"""
from __future__ import annotations

import json
import socket
import ssl
import subprocess
import sys
import urllib.request

from cf_api import load_state


def doh_lookup(name: str) -> tuple[int, list[str], str]:
    """Returns (status, ip_list, authority_summary)."""
    req = urllib.request.Request(
        f"https://dns.google/resolve?name={name}&type=A",
        headers={"accept": "application/dns-json"},
    )
    d = json.loads(urllib.request.urlopen(req, timeout=10).read())
    ips = [a["data"] for a in d.get("Answer", []) if a.get("type") == 1]
    auth = ", ".join(a.get("data", "")[:60] for a in d.get("Authority", []))
    return d.get("Status", -1), ips, auth


def tls_check(host: str) -> tuple[bool, str]:
    """True if TLS handshake completes and a cert is presented."""
    try:
        ctx = ssl.create_default_context()
        with socket.create_connection((host, 443), timeout=10) as sock:
            with ctx.wrap_socket(sock, server_hostname=host) as ssock:
                cert = ssock.getpeercert()
                cn = dict(x[0] for x in cert.get("subject", []))
                return True, f"cert CN={cn.get('commonName', '?')}, issuer={cert.get('issuer', [[('?',)]])[0][0][1]}"
    except ssl.SSLError as e:
        return False, f"SSL error: {e}"
    except Exception as e:
        return False, f"{type(e).__name__}: {e}"


def http_check(host: str) -> tuple[int, int]:
    """Returns (status_code, body_size)."""
    try:
        with urllib.request.urlopen(f"https://{host}/", timeout=15) as r:
            body = r.read()
            return r.status, len(body)
    except urllib.error.HTTPError as e:
        return e.code, 0
    except Exception:
        return 0, 0


def main() -> int:
    state = load_state()
    host = state.get("hostname")
    if not host:
        print("❌ No hostname in state. Run setup.py first.")
        return 2

    print(f"🔍 Diagnosing {host}\n")

    # Stage 1: DNS
    status, ips, auth = doh_lookup(host)
    if status == 0 and ips:
        print(f"✅ DNS:   {host} → {', '.join(ips)}")
    elif status == 3:
        if "trs-dns" in auth or "tucows" in auth or "verisign" in auth:
            print(f"⏳ DNS:   TLD registry hasn't propagated the new domain yet.")
            print(f"         Authority = {auth}")
            print(f"         → Wait 30 min – 24 h for new domains. Nothing to fix.")
        else:
            print(f"⏳ DNS:   NXDOMAIN. Authority = {auth or '(none)'}")
        return 0
    else:
        print(f"⚠ DNS:   Status={status}, IPs={ips}, Authority={auth}")
        return 0

    # Stage 2: TLS
    ok, info = tls_check(host)
    if ok:
        print(f"✅ TLS:   {info}")
    else:
        print(f"⏳ TLS:   {info}")
        print(f"         → Cloudflare Universal SSL not issued yet for this hostname.")
        print(f"         → Check: dash.cloudflare.com → {state.get('zone_name','<domain>')} → SSL/TLS → Edge Certificates")
        print(f"         → Typical wait for new domains: 15 min – 24 h. Nothing else to fix.")
        return 0

    # Stage 3: HTTP
    code, size = http_check(host)
    if code == 200:
        print(f"✅ HTTP:  200 OK ({size} bytes)")
        print(f"\n🎉 https://{host}/ is LIVE.")
    elif code in (301, 302):
        print(f"✅ HTTP:  {code} redirect")
    elif code in (502, 521, 522, 523, 530):
        print(f"❌ HTTP:  {code} — Tunnel up but local service unreachable.")
        print(f"         → Make sure your service is running on port {state.get('port')}")
    else:
        print(f"⚠ HTTP:  {code}")
    return 0


if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env bash
# keepalive.sh — the SINGLE recovery brain for a Cloudflare-tunnel site.
#
# One idempotent script used in BOTH places, so start-up and self-heal can
# never drift apart:
#   • boot      : called once from workspace/setup.sh (survives container restart)
#   • watchdog  : called on a schedule_task every few minutes (survives mid-life
#                 process death — cloudflared exiting on a network blip etc.)
#
# It is generic. It reads everything it needs from .cf_state.json:
#   hostname, port, tunnel_name, and (optional) app_cmd + app_dir.
# So the same file works for ANY domain published with this skill — the calling
# agent writes ZERO project-specific shell.
#
# It NEVER calls the Cloudflare API and NEVER needs CLOUDFLARE_API_TOKEN.
# Configuration (tunnel/DNS creation, run_token) is done once by setup.py and
# persisted in .cf_state.json; keepalive only reads that and (re)launches local
# processes. This is why it is safe to run on every boot and every few minutes.
#
# Reporting (so a scheduled command-task pushes signal, not spam):
#   • healthy run                    -> SILENT (log line only)
#   • newly down, auto-recovered     -> prints ONE line  (incident + resolution)
#   • newly down, still failing      -> prints ONE line  (incident needs a human)
#   • already-known down, still down -> SILENT           (no repeat spam)
# State is tracked in run/keepalive.state so only transitions speak.
set -uo pipefail

WS="/data/workspace"
STATE="$WS/.cf_state.json"
LOGDIR="$WS/logs"; PIDDIR="$WS/run"
mkdir -p "$LOGDIR" "$PIDDIR"
LASTSTATE="$PIDDIR/keepalive.state"

ts()  { date -u +'%Y-%m-%dT%H:%M:%SZ'; }
log() { echo "[$(ts)] $*" >> "$LOGDIR/keepalive.log"; }

[ -f "$STATE" ] || {
  log "no .cf_state.json — run setup.py once to configure. nothing to do."
  exit 0
}

# --- read config from state (pure local read, no API) ---
read_state() { python3 -c "import json,sys;print(json.load(open('$STATE')).get('$1',''))" 2>/dev/null; }
HOST="$(read_state hostname)"
PORT="$(read_state port)"
APP_CMD="$(read_state app_cmd)"
APP_DIR="$(read_state app_dir)"
[ -n "$HOST" ] || { log "no hostname in state — cannot guard."; exit 0; }
[ -n "$APP_DIR" ] || APP_DIR="$WS"

APP_PID="$PIDDIR/app.pid"
TUN_PID="$PIDDIR/cloudflared.pid"

# --- probes ---
public_ok() { curl -fsS --max-time 12 "https://$HOST/" >/dev/null 2>&1; }

local_ok() {
  [ -n "$PORT" ] || { echo skip; return; }   # no app to manage -> tunnel-only mode
  python3 - "$PORT" <<'PY'
import socket, sys
s = socket.socket(); s.settimeout(1.0)
try:
    s.connect(("127.0.0.1", int(sys.argv[1]))); print("open")
except Exception:
    print("closed")
finally:
    s.close()
PY
}

# --- recovery actions (idempotent) ---
start_app() {
  [ -n "$APP_CMD" ] || { log "app down but no app_cmd in state — skipping app start"; return 1; }
  cd "$APP_DIR" 2>/dev/null || { log "ERROR app_dir not found: $APP_DIR"; return 1; }
  setsid bash -c "exec $APP_CMD" >> "$LOGDIR/app.log" 2>&1 < /dev/null &
  echo $! > "$APP_PID"
  log "started app: ($APP_CMD) in $APP_DIR pid=$(cat "$APP_PID")"
}

start_tunnel() {
  [ -f "$TUN_PID" ] && kill "$(cat "$TUN_PID" 2>/dev/null)" 2>/dev/null || true
  pkill -f "cloudflared tunnel .* run --token" 2>/dev/null || true
  rm -f "$TUN_PID"; sleep 2
  setsid bash -c "exec bash $WS/skills/cloudflare-tunnel-publish/scripts/run_tunnel.sh" \
    >> "$LOGDIR/cloudflared.log" 2>&1 < /dev/null &
  echo $! > "$TUN_PID"
  log "(re)started cloudflared pid=$(cat "$TUN_PID")"
}

heal() {
  local lo; lo="$(local_ok)"
  if [ "$lo" = "closed" ]; then
    log "WARN local app :$PORT down -> restart app + tunnel"
    start_app
    start_tunnel
  else
    log "WARN tunnel down (local :$PORT ${lo}) -> restart tunnel"
    start_tunnel
  fi
}

prev="UP"; [ -f "$LASTSTATE" ] && prev="$(cat "$LASTSTATE" 2>/dev/null || echo UP)"

# --- fast path: healthy ---
if public_ok; then
  log "ok https://$HOST"
  if [ "$prev" = "DOWN" ]; then
    echo "✅ $HOST recovered at $(ts)"
  fi
  echo "UP" > "$LASTSTATE"
  exit 0
fi

# --- down: heal, then verify with a few retries (covers cold-start tunnel warm-up) ---
heal
ok=0
for _ in 1 2 3; do
  sleep 5
  if public_ok; then ok=1; break; fi
done

if [ "$ok" = "1" ]; then
  log "recovered https://$HOST"
  echo "🔧 $HOST was down — auto-recovered at $(ts)"
  echo "UP" > "$LASTSTATE"
  exit 0
else
  log "ERROR still down https://$HOST after heal"
  if [ "$prev" != "DOWN" ]; then
    echo "🚨 $HOST is DOWN and auto-recovery failed at $(ts) — needs a manual look (check logs/cloudflared.log, logs/app.log)"
  fi
  echo "DOWN" > "$LASTSTATE"
  exit 1
fi

#!/usr/bin/env bash
# Download cloudflared if missing, then start the tunnel.
# Run with bash(background=true) — this script blocks while cloudflared runs.
set -euo pipefail

WORKSPACE="/data/workspace"
BIN_DIR="$WORKSPACE/bin"
BIN="$BIN_DIR/cloudflared"
STATE="$WORKSPACE/.cf_state.json"

mkdir -p "$BIN_DIR"

if [[ ! -x "$BIN" ]]; then
    echo "→ Downloading cloudflared..."
    arch=$(uname -m)
    case "$arch" in
        x86_64) suffix="amd64" ;;
        aarch64|arm64) suffix="arm64" ;;
        *) echo "Unsupported arch: $arch"; exit 2 ;;
    esac
    url="https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${suffix}"
    curl -fsSL -o "$BIN" "$url"
    chmod +x "$BIN"
    echo "✅ cloudflared installed at $BIN"
fi

if [[ ! -f "$STATE" ]]; then
    echo "❌ Missing $STATE — run setup.py first."
    exit 2
fi

TOKEN=$(python3 -c "import json; print(json.load(open('$STATE'))['run_token'])")

if [[ -z "$TOKEN" ]]; then
    echo "❌ run_token missing from state."
    exit 2
fi

echo "→ Starting cloudflared tunnel..."
exec "$BIN" tunnel --no-autoupdate run --token "$TOKEN"

"""Create (or reuse) a remotely-managed Cloudflare Tunnel, configure ingress,
create the DNS CNAME, and save everything to .cf_state.json.

Usage:
  python3 setup.py --hostname app.example.com --port 8080
  python3 setup.py --hostname app.example.com --port 8080 --service-host 127.0.0.1

  # Recommended: record how to (re)start the local app so keepalive.sh can bring
  # the WHOLE site back by itself after a container restart or an app crash:
  python3 setup.py --hostname app.example.com --port 8080 \
      --app-cmd "python3 server.py" --app-dir projects/myapp

setup.py is CONFIG-TIME, not start-time. It calls the Cloudflare API to
create/reuse the tunnel + DNS and writes .cf_state.json. Run it ONCE per domain
(or again only when reconfiguring). NEVER put setup.py in workspace/setup.sh —
on every restart it would re-hit the API and may rotate the run_token. Boot and
self-heal are handled by keepalive.sh, which only READS .cf_state.json.
"""
from __future__ import annotations

import argparse
import base64
import os
import secrets
import sys

from cf_api import cf_request, load_state, update_state


def find_existing_tunnel(account_id: str, name: str) -> dict | None:
    """List tunnels and return one with matching name (not deleted)."""
    r = cf_request("GET", f"/accounts/{account_id}/cfd_tunnel?is_deleted=false&name={name}")
    for t in r.get("result", []):
        if t.get("name") == name and not t.get("deleted_at"):
            return t
    return None


def create_tunnel(account_id: str, name: str) -> dict:
    """Create a remotely-managed tunnel (config_src=cloudflare).

    Note: API also requires `tunnel_secret` — a 32-byte base64 string. Even for
    config_src=cloudflare, supplying a secret keeps the API happy and lets
    locally-managed mode work as fallback.
    """
    secret = base64.b64encode(secrets.token_bytes(32)).decode()
    body = {"name": name, "config_src": "cloudflare", "tunnel_secret": secret}
    r = cf_request("POST", f"/accounts/{account_id}/cfd_tunnel", body=body)
    return r["result"]


def fetch_run_token(account_id: str, tunnel_id: str) -> str:
    r = cf_request("GET", f"/accounts/{account_id}/cfd_tunnel/{tunnel_id}/token")
    # `result` is the token string (already a JSON-encoded string)
    return r["result"]


def put_ingress_config(
    account_id: str, tunnel_id: str, hostname: str, service_url: str
) -> None:
    body = {
        "config": {
            "ingress": [
                {"hostname": hostname, "service": service_url},
                {"service": "http_status:404"},
            ]
        }
    }
    cf_request(
        "PUT",
        f"/accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations",
        body=body,
    )


def upsert_dns_cname(zone_id: str, hostname: str, target: str) -> dict:
    """Create or update a proxied CNAME record."""
    # Look for an existing record at this name
    existing = cf_request("GET", f"/zones/{zone_id}/dns_records?name={hostname}")
    body = {
        "type": "CNAME",
        "name": hostname,
        "content": target,
        "proxied": True,
        "ttl": 1,  # 1 = automatic
        "comment": "Managed by cloudflare-tunnel-publish skill",
    }
    if existing.get("result"):
        rec = existing["result"][0]
        r = cf_request(
            "PUT", f"/zones/{zone_id}/dns_records/{rec['id']}", body=body
        )
    else:
        r = cf_request("POST", f"/zones/{zone_id}/dns_records", body=body)
    return r["result"]


def main() -> int:
    p = argparse.ArgumentParser()
    p.add_argument("--hostname", required=True, help="Public hostname, e.g. app.example.com")
    p.add_argument("--port", required=True, type=int, help="Local port to expose")
    p.add_argument("--service-host", default="localhost", help="Local host (default: localhost)")
    p.add_argument("--app-cmd", default="", help="Command to (re)start the local app, e.g. 'python3 server.py'. "
                                                 "Recorded in state so keepalive.sh can restart the app after a "
                                                 "restart/crash. Omit if the app is managed elsewhere.")
    p.add_argument("--app-dir", default="", help="Working dir for --app-cmd, relative to /data/workspace "
                                                 "(default: workspace root).")
    args = p.parse_args()

    state = load_state()
    account_id = state.get("account_id")
    zone_id = state.get("zone_id")
    zone_name = state.get("zone_name")

    if not account_id or not zone_id:
        print("❌ Missing account_id / zone_id in .cf_state.json — run verify.py first.")
        return 2

    if not args.hostname.endswith(zone_name):
        print(f"❌ Hostname {args.hostname} is not in zone {zone_name}")
        return 2

    tunnel_name = "starchild-" + args.hostname.replace(".", "-")
    service_url = f"http://{args.service_host}:{args.port}"

    # 1. Reuse or create tunnel
    existing = find_existing_tunnel(account_id, tunnel_name)
    if existing:
        tunnel = existing
        print(f"↻ Reusing existing tunnel: {tunnel_name} ({tunnel['id']})")
    else:
        tunnel = create_tunnel(account_id, tunnel_name)
        print(f"✅ Created tunnel: {tunnel_name} ({tunnel['id']})")

    # 2. Run token (refetch every time in case of rotation)
    run_token = fetch_run_token(account_id, tunnel["id"])
    print(f"✅ Fetched run token (length {len(run_token)})")

    # 3. Ingress config
    put_ingress_config(account_id, tunnel["id"], args.hostname, service_url)
    print(f"✅ Set ingress: {args.hostname} → {service_url}")

    # 4. DNS CNAME
    cname_target = f"{tunnel['id']}.cfargotunnel.com"
    upsert_dns_cname(zone_id, args.hostname, cname_target)
    print(f"✅ DNS: {args.hostname} CNAME {cname_target} (proxied)")

    # 5. Persist
    app_dir = args.app_dir.strip()
    if app_dir and not app_dir.startswith("/"):
        app_dir = f"/data/workspace/{app_dir}"
    update_state(
        hostname=args.hostname,
        port=args.port,
        service_url=service_url,
        tunnel_id=tunnel["id"],
        tunnel_name=tunnel_name,
        run_token=run_token,
        app_cmd=args.app_cmd.strip(),
        app_dir=app_dir,
    )
    if args.app_cmd.strip():
        print(f"✅ Recorded app_cmd → keepalive.sh can auto-restart the app")
    else:
        print("ℹ️  No --app-cmd given: keepalive.sh will guard the tunnel only "
              "(it can't restart your app if it dies). Re-run with --app-cmd to enable full self-heal.")
    print(f"\n→ State saved. Start (and self-heal) the whole site with ONE script:")
    print(f"    bash skills/cloudflare-tunnel-publish/scripts/keepalive.sh")
    print(f"→ After ~15s, check: curl -I https://{args.hostname}")
    print(f"→ For durability, add keepalive.sh to workspace/setup.sh AND schedule it. See SKILL.md.")
    return 0


if __name__ == "__main__":
    sys.exit(main())

"""Remove DNS record + delete tunnel + clear state. Use when user wants to
disconnect a custom domain.

Does NOT kill the cloudflared background process — caller should do that
via bash_process(action='kill', session_id=state['cloudflared_session_id']).
"""
from __future__ import annotations

import sys

from cf_api import cf_request, load_state, save_state, STATE_PATH


def delete_dns(zone_id: str, hostname: str) -> int:
    r = cf_request("GET", f"/zones/{zone_id}/dns_records?name={hostname}")
    n = 0
    for rec in r.get("result", []):
        cf_request("DELETE", f"/zones/{zone_id}/dns_records/{rec['id']}")
        n += 1
    return n


def delete_tunnel(account_id: str, tunnel_id: str) -> bool:
    # Tunnel must have no active connections; cleanup first
    cf_request("DELETE", f"/accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections")
    cf_request("DELETE", f"/accounts/{account_id}/cfd_tunnel/{tunnel_id}")
    return True


def main() -> int:
    state = load_state()
    if not state:
        print("Nothing to tear down — no .cf_state.json")
        return 0

    zone_id = state.get("zone_id")
    hostname = state.get("hostname")
    account_id = state.get("account_id")
    tunnel_id = state.get("tunnel_id")

    if zone_id and hostname:
        n = delete_dns(zone_id, hostname)
        print(f"✅ Deleted {n} DNS record(s) for {hostname}")

    if account_id and tunnel_id:
        try:
            delete_tunnel(account_id, tunnel_id)
            print(f"✅ Deleted tunnel {tunnel_id}")
        except Exception as e:
            print(f"⚠ Tunnel delete failed (you may need to stop cloudflared first): {e}")

    # Clear publishing state but keep account/zone for next run
    keep = {
        k: state[k]
        for k in ("account_id", "zone_id", "zone_name")
        if k in state
    }
    save_state(keep)
    print(f"→ State reset. Account/zone kept for next setup.")
    return 0


if __name__ == "__main__":
    sys.exit(main())

"""Verify CLOUDFLARE_API_TOKEN, fetch account_id, list zones.

Output is human-readable so the agent can show it directly to the user.
Side effect: writes account_id (and the first zone if only one) to .cf_state.json.
"""
from __future__ import annotations

import sys

from cf_api import cf_request, update_state, load_state


def main() -> int:
    # 1. Verify token is valid
    try:
        v = cf_request("GET", "/user/tokens/verify")
    except Exception as e:
        print(f"❌ Token verification failed: {e}")
        return 1
    if not v.get("success"):
        print(f"❌ Token invalid: {v}")
        return 1
    print("✅ Token valid")

    # 2. Fetch zones first — each zone embeds account.id, so we can derive
    #    account_id even if /accounts isn't visible to this token (the
    #    Cloudflare-Tunnel:Edit perm doesn't include account-listing).
    zones = cf_request("GET", "/zones?per_page=50")
    zone_list = zones.get("result", [])
    if not zone_list:
        print("⚠ No domains found. Add a domain to Cloudflare first.")
        return 0

    # Derive account_id from zones
    account_ids = {z["account"]["id"] for z in zone_list}
    if len(account_ids) > 1:
        print("⚠ Zones span multiple accounts — using the first zone's account.")
    acct = zone_list[0]["account"]
    account_id = acct["id"]
    print(f"✅ Account: {acct.get('name', '(name hidden)')} ({account_id})")

    print(f"\n✅ Domains on this account ({len(zone_list)}):")
    for i, z in enumerate(zone_list, 1):
        status_flag = "✓" if z["status"] == "active" else f"⚠ {z['status']}"
        print(f"  {i}. {z['name']}  [{status_flag}]  zone_id={z['id']}")

    # If exactly one active zone, auto-select it
    active = [z for z in zone_list if z["status"] == "active"]
    state_update = {"account_id": account_id}
    if len(active) == 1:
        z = active[0]
        state_update.update(zone_id=z["id"], zone_name=z["name"])
        print(f"\n→ Auto-selected the only active zone: {z['name']}")
    update_state(**state_update)

    print(f"\nState saved to /data/workspace/.cf_state.json")
    return 0


if __name__ == "__main__":
    sys.exit(main())