weicy98/dsh-cftunnel

安装

dsh plugin --profile web add git+https://github.com/weicy98/dsh-cftunnel
   ```

2. **Restart `dsh web`**, open **Settings → Cloudflare Tunnel**.
3. **Pick a mode, fill in your Cloudflare info, click Connect.** Copy the access URL (it embeds a token on first use) and share it.

> The first Connect downloads `cloudflared` (~40 MB) once — on slow networks this can take several minutes; the Settings panel shows a progress bar while it downloads. 

## Modes

Pick the mode that matches what you have:

| Mode | Inputs | URL | Use when |
| --- | --- | --- | --- |
| Quick tunnel | none | random `https://<name>.trycloudflare.com` | you want a URL right now, no Cloudflare account setup |
| Tunnel token | tunnel token + hostname | `https://<hostname>` | you already have a tunnel from the Zero Trust dashboard |
| API token | API token + tunnel name + hostname | `https://<hostname>` | you want the plugin to create the tunnel, DNS, and (optionally) email OTP for you |

## How it works, end to end

1. The Settings section shows a mode picker (Quick / Tunnel token / API token) and a **Connect** button.
2. On Connect the plugin first **self-provisions `cloudflared`** — if `$DSH_HOME/cloudflared/cloudflared` is missing it downloads the official GitHub release asset for your platform, extracts it, and caches it.
3. It starts the tunnel:
   - **Quick**: `cloudflared tunnel --url http://127.0.0.1:<proxyPort>` → random `https://<name>.trycloudflare.com`.
   - **Token**: `cloudflared tunnel run` with a remotely-managed token (routing/ingress configured in the Zero Trust dashboard).
   - **API**: create the tunnel + ingress + DNS CNAME through the Cloudflare HTTP API, then `cloudflared tunnel run` with the returned token (no `cert.pem`, no local config.yml).
4. All tunnel traffic flows through a **loopback reverse proxy** (`127.0.0.1:<proxyPort>`) that rewrites the Host header to loopback and drops Origin, so the harness trust fence accepts every request — privileged methods included. Access-token verification (default on) and optional Cloudflare Access email OTP gate the proxy.
5. **Secrets** (API token, tunnel token, proxy access token) live in the harness credential store (`~/.dsh/.credentials.yaml`); **non-secret preferences** (mode, hostname, tunnel name, account/zone ids, email-OTP settings) live in a `cloudflare-tunnel` settings namespace (`~/.dsh/settings.yaml`) and prefill the form on the next open.

## Install

From this checkout's directory:

把 weicy98/dsh-cftunnel 加入你的 DSH 配置（web profile）即可启用。