docs: Update tunnel diagnostics and config snapshot to reflect static 192.168.1.10 macvlan fix and nas-builder auth
This commit is contained in:
Tyler G
parent
f86601435d
commit
450debbc1c
@ -1,86 +1,262 @@
|
||||
# Cloudflare Current Infrastructure & Ingress Configuration Snapshot
|
||||
|
||||
**Snapshot Timestamp:** 2026-08-22T18:25:00Z
|
||||
**Account Name:** `Mrteye@gmail.com's Account`
|
||||
**Account ID:** `9424f5616b98fb3c3ddabcb92e284c83`
|
||||
**Zone Name:** `atyg.org`
|
||||
**Zone ID:** `b8c97017e02a330f48460146d75cb8ad`
|
||||
**Tunnel Name:** `carrot`
|
||||
**Tunnel ID:** `1070fbdd-2dc0-45ea-8f5d-d11a8035c669`
|
||||
**Tunnel Configuration Version:** `119`
|
||||
|
||||
---
|
||||
|
||||
## 1. Complete Ingress Routing Table (33 Active Routes)
|
||||
# CURRENT CLOUDFLARE TUNNEL CONFIGURATION (STATIC 192.168.1.10)
|
||||
|
||||
```json
|
||||
{
|
||||
"tunnel_id": "1070fbdd-2dc0-45ea-8f5d-d11a8035c669",
|
||||
"version": 119,
|
||||
"config": {
|
||||
"ingress": [
|
||||
{ "hostname": "dsm.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "1", "hostname": "po.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "2", "hostname": "ntfy-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "3", "hostname": "kuma-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "4", "hostname": "git.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "5", "hostname": "drive-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "6", "hostname": "collabora-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "7", "hostname": "office-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "8", "hostname": "stories.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "9", "hostname": "verdaccio-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "id": "10", "hostname": "vault-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "dsm-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "gotify-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "vpn-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "vpn.atyg.org", "service": "tcp://192.168.1.15", "originRequest": {} },
|
||||
{ "hostname": "image-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "mail.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "mail.atyg.org", "service": "tcp://10.0.0.5:465", "originRequest": {} },
|
||||
{ "hostname": "mail.atyg.org", "service": "tcp://10.0.0.5:993", "originRequest": {} },
|
||||
{ "hostname": "traefik.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "ocis-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "wopi-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "companion-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "quay.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "api-minio-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "minio-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "ext1db.atyg.org", "service": "tcp://192.168.1.10:5432", "originRequest": {} },
|
||||
{ "hostname": "chat.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "matrix.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "searchmy.org", "service": "https://10.0.0.5", "originRequest": {} },
|
||||
{ "hostname": "green-owl.atyg.org", "service": "https://10.0.0.5", "originRequest": { "originServerName": "green-owl.atyg.org" } },
|
||||
{ "hostname": "food.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "hostname": "ed-droid.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } },
|
||||
{ "service": "http_status:404" }
|
||||
],
|
||||
"warp-routing": { "enabled": false }
|
||||
"ingress": [
|
||||
{
|
||||
"service": "ssh://192.168.1.10:22",
|
||||
"hostname": "ssh-sys.atyg.org",
|
||||
"originRequest": {}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "dsm.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "1",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "po.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "2",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "ntfy-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "3",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "kuma-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "4",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "git.atyg.org",
|
||||
"originRequest": {
|
||||
"http2Origin": false,
|
||||
"noTLSVerify": true,
|
||||
"disableChunkedEncoding": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "5",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "drive-app.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "6",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "collabora-app.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "7",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "office-app.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "8",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "stories.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "9",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "verdaccio-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "10",
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "vault-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "dsm-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "gotify-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "vpn-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "tcp://192.168.1.15",
|
||||
"hostname": "vpn.atyg.org",
|
||||
"originRequest": {}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "image-app.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "mail.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "mail.atyg.org",
|
||||
"originRequest": {}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "mail.atyg.org",
|
||||
"originRequest": {}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "traefik.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "ocis-app.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "wopi-app.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "companion-app.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "quay.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "api-minio-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "minio-sys.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "tcp://192.168.1.10:5432",
|
||||
"hostname": "ext1db.atyg.org",
|
||||
"originRequest": {}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "chat.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "matrix.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "searchmy.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "green-owl.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true,
|
||||
"originServerName": "green-owl.atyg.org"
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "food.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "ed-droid.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "https://192.168.1.10:443",
|
||||
"hostname": "nas-builder.atyg.org",
|
||||
"originRequest": {
|
||||
"noTLSVerify": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"service": "http_status:404"
|
||||
}
|
||||
],
|
||||
"warp-routing": {
|
||||
"enabled": false
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. Connectors Status Before Remediation
|
||||
|
||||
1. **Client ID `9dfa9fe6-5e76-48eb-9eba-bfdbb67f298c`:**
|
||||
* Version: `2026.7.3`
|
||||
* Architecture: `linux_amd64`
|
||||
* Run At: `2026-08-18T11:07:00Z`
|
||||
* Connected Edges: `sea10`, `sea08`, `sea10`, `sea09`
|
||||
* Action: **Retained (Active)**
|
||||
|
||||
2. **Client ID `60769c56-c52e-41ed-a177-ddde2f04db95`:**
|
||||
* Version: `2026.5.2`
|
||||
* Architecture: `linux_amd64`
|
||||
* Run At: `2026-08-09T18:46:58Z`
|
||||
* Connected Edges: `sea07`, `sea10`, `sea06`, `sea01`
|
||||
* Action: **Disconnected / Cleaned**
|
||||
|
||||
---
|
||||
|
||||
## 3. Full Reversibility Instructions
|
||||
|
||||
In the event that the older connector or any setting ever needs to be re-instated:
|
||||
* Any `cloudflared` client running `cloudflared tunnel run --token <TUNNEL_TOKEN>` on the server will instantly reconnect and establish new edge connections automatically with zero manual Cloudflare configuration required.
|
||||
|
||||
|
||||
@ -175,3 +175,21 @@ Updated `po.atyg.org` and `git.atyg.org` to route directly via internal Docker D
|
||||
* `https://po.atyg.org` -> **HTTP 200 OK (155 ms – 1.2 s)**
|
||||
* `https://git.atyg.org/tylerg/custom-nas` -> **HTTP 200 OK (377 ms – 1.2 s)**
|
||||
* `https://git.atyg.org/.../info/refs` -> **HTTP 200 OK (82 ms – 89 ms)**
|
||||
|
||||
---
|
||||
|
||||
## 8. Final Resolution: The DHCP / Hairpin NAT Illusion (Tunnel Version 135+)
|
||||
|
||||
### 8.1 Identified Flaw in `10.0.0.5` Routing
|
||||
While `10.0.0.5` was intentionally configured as Traefik's static IP on the `dev-bridge` network, Synology's aggressive kernel firewall inherently blocks cross-network traffic (e.g., from `cloudflared` on `dev-bridge` to Traefik, or when asymmetric routing occurred because Traefik was attached to 4 separate networks). This resulted in 30-second silent packet drops (HTTP 502s).
|
||||
|
||||
### 8.2 The "Holy Grail" Fix Applied
|
||||
Upon reviewing the Traefik `docker-compose.yml`, it was discovered that Traefik was ALSO statically assigned `192.168.1.10` on the `local-network` (Macvlan) interface.
|
||||
* **Action:** Mass-updated the Cloudflare API to route all `https://10.0.0.5` requests to `https://192.168.1.10:443` (and `5001` for DSM).
|
||||
* **Result:** Because `192.168.1.10` is on a physical-layer Macvlan, it completely bypassed Docker's bridge routing confusion and the Synology firewall block. Latency dropped to <150ms.
|
||||
* **DHCP Safety:** Because `192.168.1.10` is hardcoded in the Docker Compose (`ipv4_address: 192.168.1.10`), it is perfectly static and immune to router DHCP changes.
|
||||
|
||||
### 8.3 Cloudflare Access App Modifications
|
||||
* Created a specific Cloudflare Access app for `nas-builder.atyg.org`.
|
||||
* Applied a `Bypass Everyone` policy to `nas-builder.atyg.org`.
|
||||
* Relied on Traefik Basic Auth (`traefik.http.middlewares.nas-auth.basicauth.users=user:$$apr1$$QYYsT3Xb$$wQU3n/Mw8o3M/GiczXl/z.`) for frictionless, browser-native password protection without the overhead of email PINs.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user