The host tunnel config lists each app's own domain #11873

The host tunnel config now has one ingress rule per app domain. It is generated from the app_domain table rather than hand-written. infra/forge-box/cloudflared-forge.yml did not exist on this branch, so I created it.

What changed

• src/system/tunnel_config.ts renders the ingress, which has three parts:

- the three forge hostnames: forge.open-platform.sh, --forge.open-platform.sh and --forge-trevato-apps.open-platform.sh; - one rule per app domain; - a final http_status:404.

• Every rule points at http://127.0.0.1:3000. A hostname with a newline or other junk makes the renderer throw.
• scripts/tunnel-config.ts --db <forge.db> [--write] reads the table read-only and either prints the config or rewrites the yml. The forge.db path comes from --db, or from $FORGE_DATA.
• The committed yml carries the two domains the forge serves today, game.cheffryjames.com and www.cheffryjames.com. I took these from docs/OPERATING.md, not from the live table, because I can't read it here.
• test/forge-box-unit.test.ts has a new test:

- Every app_domain row, verified or not, gets a rule. - The forge hostnames and the 404 catch-all are present. - A bad hostname is refused. - The committed yml equals what the generator renders.

bun test test/forge-box-unit.test.ts, bun x tsc --noEmit and bun scripts/gate.ts pass.

Left out

• The tunnel name and credentials file are not in the yml. They belong on the box.
• Nothing re-runs the generator when a domain is added. After a domain is added, someone runs bun scripts/tunnel-config.ts --db … --write on the box and restarts cloudflared-forge.
• The three forge hostnames are my reading of docs/OPERATING.md, since the issue doesn't name them. Please check them.
• Unverified domains also get a rule. The forge refuses to serve a domain it hasn't verified, so this is harmless.

Try it Run bun scripts/tunnel-config.ts --db <path to a forge.db>.

Closes #11871

The host tunnel config now has one ingress rule per app domain. It is generated from the app_domain table rather than hand-written. infra/forge-box/cloudflared-forge.yml did not exist on this branch, so I created it.

What changed

• src/system/tunnel_config.ts renders the ingress, which has three parts:

- the three forge hostnames: forge.open-platform.sh, --forge.open-platform.sh and --forge-trevato-apps.open-platform.sh; - one rule per app domain; - a final http_status:404.

• Every rule points at http://127.0.0.1:3000. A hostname with a newline or other junk makes the renderer throw.
• scripts/tunnel-config.ts --db <forge.db> [--write] reads the table read-only and either prints the config or rewrites the yml. The forge.db path comes from --db, or from $FORGE_DATA.
• The committed yml carries the two domains the forge serves today, game.cheffryjames.com and www.cheffryjames.com. I took these from docs/OPERATING.md, not from the live table, because I can't read it here.
• test/forge-box-unit.test.ts has a new test:

- Every app_domain row, verified or not, gets a rule. - The forge hostnames and the 404 catch-all are present. - A bad hostname is refused. - The committed yml equals what the generator renders.

bun test test/forge-box-unit.test.ts, bun x tsc --noEmit and bun scripts/gate.ts pass.

Left out

• The tunnel name and credentials file are not in the yml. They belong on the box.
• Nothing re-runs the generator when a domain is added. After a domain is added, someone runs bun scripts/tunnel-config.ts --db … --write on the box and restarts cloudflared-forge.
• The three forge hostnames are my reading of docs/OPERATING.md, since the issue doesn't name them. Please check them.
• Unverified domains also get a rule. The forge refuses to serve a domain it hasn't verified, so this is harmless.

Try it Run bun scripts/tunnel-config.ts --db <path to a forge.db>.