Repository navigation
Conversation
utils/cloudflare_setup.sh puts the panel's hostnames on Cloudflare with one scoped API token: DNS records (ours carry a comment; anyone else's are only replaced after a yes), the orange cloud on every hostname except demo uploads and TURN, a Configuration Rule with HTTPS Full (strict), a Cache Rule for live data, and read-only checks that stop on Bot Fight Mode. Names deeper than Cloudflare's free certificate covers stay DNS-only. With CLOUDFLARE_MANAGED=true, update.sh re-syncs the records before the apply and turns the proxy on once certificates are ready, rolling a host back on a 52x. cert-manager proves the zones through a Cloudflare DNS-01 solver ahead of HTTP-01. setup-env.sh asks for it, and ./cloudflare.sh adds it to an existing install.
lukepolo
force-pushed
the
feature/agent
branch
from
November 3, 2026 14:17
2bc38d9 to
e655de5
Compare
… the plain Cloudflare proxy
…ideo stays off the plain proxy and the server address stays hidden (#722)
…Encrypt's check through The DNS-01 solver, the cloudflare-secrets Secret and the Vault ExternalSecret are gone, so the Cloudflare key is never in the cluster: the engine reads it from the host's local secrets file or from Vault kv/cloudflare with the vault CLI. Setup turns Always Use HTTPS off behind a 5Stack Redirect Rule that sends everything but /.well-known/acme-challenge/ to HTTPS, keeps security challenges off that path, names other rules that catch it, and keeps a host's proxy on only when an acme-check request gets the panel's own answer through Cloudflare.
…panel beside the https-redirect The acme-check Ingress is applied with the rest of the routing layer, and the fresh-install test checks that /.well-known/acme-challenge/5stack-check reaches the panel with its X-5Stack-Check header on every host while other challenge paths still redirect.
… Ingress, on Traefik's class
…nel-api.example.com beside panel.example.com
…is on, and the free plan puts every address one level deep
…for a subdomain panel, and recommends it on Cloudflare's free plan
…nstall skips it, and no kubectl exec can hang an update The step sat silent for up to five minutes while the first start pulled the image. A panel with no timescaledb volume yet has nothing to update, and every kubectl exec in the update path (the extension queries, the PG_VERSION reads, vacuumdb, the signed clip link check) now runs under a time limit.
…, and a key the 5Stack service passes isn't reported missing With REVERSE_PROXY=true the panel issues no certificates, so the engine skips the Let's Encrypt check through Cloudflare, its challenge-path and redirect rules and Always Use HTTPS, and keeps only the origin check. setup-env.sh keeps REVERSE_PROXY=true alongside CLOUDFLARE_MANAGED, and only warns about a missing token when neither CLOUDFLARE_API_TOKEN nor the secrets file has one.
…d never adds the shared 10.42 lines for it PANEL_POD_RANGE, PANEL_SERVICE_RANGE and PANEL_TAILSCALE_TAG in .5stack-env.config set the routes, grants, tag owner and key tags game-node-server-setup.sh writes, and the k3s it installs keeps those ranges. Without them, a cluster whose pods are outside 10.42.0.0/16 is refused.
…, with the zone rules set first The records step now sets the zone rules (configuration, cache and, for a panel issuing its own certificates, the ACME and HTTPS redirect rules) and then creates or updates every hostname the plan proxies with the orange cloud on. Demo uploads, streams, TURN and anything else the plan keeps direct stay DNS only. An existing DNS-only 5Stack record for a proxied hostname is turned orange on the next run. The late proxy step keeps its origin check and, outside reverse-proxy mode, its ACME check, and still puts a failing hostname back to DNS only. A zone that fails the readiness check gets its records as they are, without rules or the orange cloud.
….sh's records and proxy steps With CLOUDFLARE_RECORDS_SET=true, update.sh leaves out "Updating the panel's Cloudflare records" and "Putting Cloudflare in front of the panel". It only checks each proxied host through Cloudflare and puts one that answers 52x back to DNS only. The stream relay Worker step still runs. Without the variable nothing changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
5Stack can now manage a panel's Cloudflare zone with one scoped API token, so DNS, the proxy and HTTPS are set up for the owner while certificates stay on cert-manager's HTTP-01 check.
utils/cloudflare_setup.sh(plan,records,proxy,status,fix,tiered-cache): records carry a 5Stack comment, other people's records are only replaced after a yes, MX/TXT are never touched, a CAA without Let's Encrypt is warned about, andCLOUDFLARE_ZONEkeeps it to the picked zone.DEMOS_DOMAIN,GAME_STREAM_DOMAINand TURN; Worker hostnames are left alone; names deeper than the free certificate (or off port 443) stay DNS-only.ref, never by replacing an entrypoint:5stack_paneland5stack_panel_acme(no security challenge on/.well-known/acme-challenge/),5stack_panel_no_cache, and the Redirect Rule5stack_panel_https, which sends plain HTTP to HTTPS except the challenge path, after which Always Use HTTPS goes off; Bot Fight Mode stops the proxy step, and other people's Redirect or Page Rules that catch the path are named.update.shre-syncs records before the apply and turns the proxy on only after certificates exist, host by host, sending a host back to DNS only on a 52x or whenhttp://<host>/.well-known/acme-challenge/5stack-checkdoesn't get the panel's own answer (the newacme-checkroute) through Cloudflare.overlays/local-secrets/cloudflare-secrets.envon the host, outside every overlay, or in Vaultkv/cloudflare; there is no DNS-01 solver and no Cloudflare Secret in5stack.setup-env.shasks "Set up DNS, proxy and SSL automatically?" (or--cloudflare-managed) and offers Cloudflare's token page with the permissions filled in;./cloudflare.shdoes it for an existing install.