Part of #11686, item 1. Today every public request goes tunnel → Traefik (pg-grand) → the forge (docs/OPERATING.md).
Done:
[ ] The vxrail's tunnel (standby/cloudflared-forge-home, 2 replicas) carries forge.open-platform.sh, --forge.open-platform.sh and --forge-trevato-apps.open-platform.sh straight to the forge's Service; the forge routes child and app hosts itself (with #8946).
[ ] The old path stays as the fallback until the new one has carried traffic for a day; the switch and the rollback are each one documented step in docs/OPERATING.md.
[ ] ssh (:2222) reaches the forge without forge-ssh on pg-grand.
[ ] The Traefik, IngressRoute and forge-ssh rows in FOOTING move to the vxrail.
Needs a person with the DNS and the tunnel's config: an agent writes the config and the steps, a person applies them.
Part of #11686, item 1. Today every public request goes tunnel → Traefik (pg-grand) → the forge (docs/OPERATING.md).
Done:
--forge.open-platform.shand--forge-trevato-apps.open-platform.shstraight to the forge's Service; the forge routes child and app hosts itself (with #8946).FOOTINGmove to the vxrail.Needs a person with the DNS and the tunnel's config: an agent writes the config and the steps, a person applies them.
Files: infra/forge-cloudflare/, docs/OPERATING.md, src/system/footing.ts