From 450debbc1cf0b732cc0b8fe2f27f68ddb8d199dc Mon Sep 17 00:00:00 2001 From: Tyler G Date: Sat, 22 Aug 2026 22:10:53 -0700 Subject: [PATCH] docs: Update tunnel diagnostics and config snapshot to reflect static 192.168.1.10 macvlan fix and nas-builder auth --- CLOUDFLARE_CURRENT_CONFIG_SNAPSHOT.md | 336 ++++++++++++++++++++------ CLOUDFLARE_TUNNEL_DIAGNOSTICS_LOG.md | 18 ++ 2 files changed, 274 insertions(+), 80 deletions(-) diff --git a/CLOUDFLARE_CURRENT_CONFIG_SNAPSHOT.md b/CLOUDFLARE_CURRENT_CONFIG_SNAPSHOT.md index ce15e63..26b83a6 100644 --- a/CLOUDFLARE_CURRENT_CONFIG_SNAPSHOT.md +++ b/CLOUDFLARE_CURRENT_CONFIG_SNAPSHOT.md @@ -1,86 +1,262 @@ -# Cloudflare Current Infrastructure & Ingress Configuration Snapshot - -**Snapshot Timestamp:** 2026-08-22T18:25:00Z -**Account Name:** `Mrteye@gmail.com's Account` -**Account ID:** `9424f5616b98fb3c3ddabcb92e284c83` -**Zone Name:** `atyg.org` -**Zone ID:** `b8c97017e02a330f48460146d75cb8ad` -**Tunnel Name:** `carrot` -**Tunnel ID:** `1070fbdd-2dc0-45ea-8f5d-d11a8035c669` -**Tunnel Configuration Version:** `119` - ---- - -## 1. Complete Ingress Routing Table (33 Active Routes) +# CURRENT CLOUDFLARE TUNNEL CONFIGURATION (STATIC 192.168.1.10) ```json { - "tunnel_id": "1070fbdd-2dc0-45ea-8f5d-d11a8035c669", - "version": 119, - "config": { - "ingress": [ - { "hostname": "dsm.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "1", "hostname": "po.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "2", "hostname": "ntfy-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "3", "hostname": "kuma-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "4", "hostname": "git.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "5", "hostname": "drive-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "6", "hostname": "collabora-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "7", "hostname": "office-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "8", "hostname": "stories.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "9", "hostname": "verdaccio-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "id": "10", "hostname": "vault-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "dsm-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "gotify-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "vpn-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "vpn.atyg.org", "service": "tcp://192.168.1.15", "originRequest": {} }, - { "hostname": "image-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "mail.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "mail.atyg.org", "service": "tcp://10.0.0.5:465", "originRequest": {} }, - { "hostname": "mail.atyg.org", "service": "tcp://10.0.0.5:993", "originRequest": {} }, - { "hostname": "traefik.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "ocis-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "wopi-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "companion-app.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "quay.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "api-minio-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "minio-sys.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "ext1db.atyg.org", "service": "tcp://192.168.1.10:5432", "originRequest": {} }, - { "hostname": "chat.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "matrix.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "searchmy.org", "service": "https://10.0.0.5", "originRequest": {} }, - { "hostname": "green-owl.atyg.org", "service": "https://10.0.0.5", "originRequest": { "originServerName": "green-owl.atyg.org" } }, - { "hostname": "food.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "hostname": "ed-droid.atyg.org", "service": "https://10.0.0.5", "originRequest": { "noTLSVerify": true } }, - { "service": "http_status:404" } - ], - "warp-routing": { "enabled": false } + "ingress": [ + { + "service": "ssh://192.168.1.10:22", + "hostname": "ssh-sys.atyg.org", + "originRequest": {} + }, + { + "service": "https://192.168.1.10:443", + "hostname": "dsm.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "1", + "service": "https://192.168.1.10:443", + "hostname": "po.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "2", + "service": "https://192.168.1.10:443", + "hostname": "ntfy-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "3", + "service": "https://192.168.1.10:443", + "hostname": "kuma-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "4", + "service": "https://192.168.1.10:443", + "hostname": "git.atyg.org", + "originRequest": { + "http2Origin": false, + "noTLSVerify": true, + "disableChunkedEncoding": true + } + }, + { + "id": "5", + "service": "https://192.168.1.10:443", + "hostname": "drive-app.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "6", + "service": "https://192.168.1.10:443", + "hostname": "collabora-app.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "7", + "service": "https://192.168.1.10:443", + "hostname": "office-app.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "8", + "service": "https://192.168.1.10:443", + "hostname": "stories.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "9", + "service": "https://192.168.1.10:443", + "hostname": "verdaccio-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "id": "10", + "service": "https://192.168.1.10:443", + "hostname": "vault-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "dsm-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "gotify-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "vpn-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "tcp://192.168.1.15", + "hostname": "vpn.atyg.org", + "originRequest": {} + }, + { + "service": "https://192.168.1.10:443", + "hostname": "image-app.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "mail.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "mail.atyg.org", + "originRequest": {} + }, + { + "service": "https://192.168.1.10:443", + "hostname": "mail.atyg.org", + "originRequest": {} + }, + { + "service": "https://192.168.1.10:443", + "hostname": "traefik.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "ocis-app.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "wopi-app.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "companion-app.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "quay.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "api-minio-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "minio-sys.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "tcp://192.168.1.10:5432", + "hostname": "ext1db.atyg.org", + "originRequest": {} + }, + { + "service": "https://192.168.1.10:443", + "hostname": "chat.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "matrix.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "searchmy.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "green-owl.atyg.org", + "originRequest": { + "noTLSVerify": true, + "originServerName": "green-owl.atyg.org" + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "food.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "ed-droid.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "https://192.168.1.10:443", + "hostname": "nas-builder.atyg.org", + "originRequest": { + "noTLSVerify": true + } + }, + { + "service": "http_status:404" + } + ], + "warp-routing": { + "enabled": false } } ``` - ---- - -## 2. Connectors Status Before Remediation - -1. **Client ID `9dfa9fe6-5e76-48eb-9eba-bfdbb67f298c`:** - * Version: `2026.7.3` - * Architecture: `linux_amd64` - * Run At: `2026-08-18T11:07:00Z` - * Connected Edges: `sea10`, `sea08`, `sea10`, `sea09` - * Action: **Retained (Active)** - -2. **Client ID `60769c56-c52e-41ed-a177-ddde2f04db95`:** - * Version: `2026.5.2` - * Architecture: `linux_amd64` - * Run At: `2026-08-09T18:46:58Z` - * Connected Edges: `sea07`, `sea10`, `sea06`, `sea01` - * Action: **Disconnected / Cleaned** - ---- - -## 3. Full Reversibility Instructions - -In the event that the older connector or any setting ever needs to be re-instated: -* Any `cloudflared` client running `cloudflared tunnel run --token ` on the server will instantly reconnect and establish new edge connections automatically with zero manual Cloudflare configuration required. - diff --git a/CLOUDFLARE_TUNNEL_DIAGNOSTICS_LOG.md b/CLOUDFLARE_TUNNEL_DIAGNOSTICS_LOG.md index 6f645ce..c3cae52 100644 --- a/CLOUDFLARE_TUNNEL_DIAGNOSTICS_LOG.md +++ b/CLOUDFLARE_TUNNEL_DIAGNOSTICS_LOG.md @@ -175,3 +175,21 @@ Updated `po.atyg.org` and `git.atyg.org` to route directly via internal Docker D * `https://po.atyg.org` -> **HTTP 200 OK (155 ms – 1.2 s)** * `https://git.atyg.org/tylerg/custom-nas` -> **HTTP 200 OK (377 ms – 1.2 s)** * `https://git.atyg.org/.../info/refs` -> **HTTP 200 OK (82 ms – 89 ms)** + +--- + +## 8. Final Resolution: The DHCP / Hairpin NAT Illusion (Tunnel Version 135+) + +### 8.1 Identified Flaw in `10.0.0.5` Routing +While `10.0.0.5` was intentionally configured as Traefik's static IP on the `dev-bridge` network, Synology's aggressive kernel firewall inherently blocks cross-network traffic (e.g., from `cloudflared` on `dev-bridge` to Traefik, or when asymmetric routing occurred because Traefik was attached to 4 separate networks). This resulted in 30-second silent packet drops (HTTP 502s). + +### 8.2 The "Holy Grail" Fix Applied +Upon reviewing the Traefik `docker-compose.yml`, it was discovered that Traefik was ALSO statically assigned `192.168.1.10` on the `local-network` (Macvlan) interface. +* **Action:** Mass-updated the Cloudflare API to route all `https://10.0.0.5` requests to `https://192.168.1.10:443` (and `5001` for DSM). +* **Result:** Because `192.168.1.10` is on a physical-layer Macvlan, it completely bypassed Docker's bridge routing confusion and the Synology firewall block. Latency dropped to <150ms. +* **DHCP Safety:** Because `192.168.1.10` is hardcoded in the Docker Compose (`ipv4_address: 192.168.1.10`), it is perfectly static and immune to router DHCP changes. + +### 8.3 Cloudflare Access App Modifications +* Created a specific Cloudflare Access app for `nas-builder.atyg.org`. +* Applied a `Bypass Everyone` policy to `nas-builder.atyg.org`. +* Relied on Traefik Basic Auth (`traefik.http.middlewares.nas-auth.basicauth.users=user:$$apr1$$QYYsT3Xb$$wQU3n/Mw8o3M/GiczXl/z.`) for frictionless, browser-native password protection without the overhead of email PINs.