FactoryWager Wiki

Tenant: tunnel-inventory

Tenant cloudflared-tunnels (machine-side cloudflared state, ~/.cloudflared/) Scope Local tunnels for factory-wager.com hostnames — audited 2026-07-27, re-verified 2026-07-28 Owner human (no repo SSOT; configs are machine-local)

Tunnels

Tunnel Hostname Target Config file Status
accounting-ledger (2029fc06-…) ledger.factory-wager.com http://127.0.0.1:3000 ~/.cloudflared/config-ledger.yml DNS resolves; manual run only · Cloudflare Access APPLIED 2026-07-28 (302 → factory-wager.cloudflareaccess.com login)
accounting-ledger dev variant ledger.factory-wager.com /app/* http://127.0.0.1:5173 (Vite) ~/.cloudflared/config-ledger-dev.yml Manual run only
prometheus (fa7dbf98-…) — none (catch-all only) http://localhost:9090 ~/.cloudflared/prometheus-config.yml No hostname ingress; no DNS route known
reasonix-serve reasonix.factory-wager.com (would be) http://localhost:8787 scripts/cloudflared-reasonix.yml DECOMMISSIONED 2026-07-28 — template deleted, staged Access app dropped, surface retired

Both config-ledger.yml headers claim “Generated by bun run tunnel:init” — no such script exists anywhere in the monorepo (grep verified). Origin of those files is unknown — treat provenance claim as stale metadata, not evidence.

Credentials (~/.cloudflared/)

File Referenced by Status
2029fc06-5bbf-415e-9fa1-6b7d3f0b1527.json config-ledger.yml, config-ledger-dev.yml Live (accounting-ledger)
fa7dbf98-3128-4b8d-9b6e-6e0e7fd2c8e6.json prometheus-config.yml Live (prometheus tunnel)
293ba37a-844f-413d-8b40-b9a9f8ae1c2a.json nothing Orphaned — was the tunnel behind deleted terminal.factory-wager.com CNAME (removed 2026-07-28). Dead tunnel still lives in the other CF account; local credential optional to delete.
cert.pem cloudflared login Full-account origin cert

Credential files were left in place; deletion is a human decision.

DNS (re-verified live 2026-07-28 · terminal CNAME re-checked 2026-07-29)

Hostname Resolves Serving
ledger.factory-wager.com Yes — Cloudflare proxy IPs 302 → Cloudflare Access login (Access app live)
terminal.factory-wager.com No CNAME deleted 2026-07-28 (was dangling tunnel → 502). Brand/DNS overview: docs/brand-alignment.md
reasonix.factory-wager.com No —

Service management

launchd (user LaunchAgent) installed 2026-07-28 — ~/Library/LaunchAgents/com.factorywager.ledger-tunnel.plist runs cloudflared tunnel --config ~/.cloudflared/config-ledger.yml run with RunAtLoad + KeepAlive (30s throttle), logs to ~/.cloudflared/ledger-tunnel.{out,err}.log. Verified: 3 QUIC connections registered, state = running, origin 127.0.0.1:3000/api/registry/health = 200. Manage: launchctl kickstart -k gui/$(id -u)/com.factorywager.ledger-tunnel (restart) · launchctl bootout gui/$(id -u)/com.factorywager.ledger-tunnel (stop). Binary: /opt/homebrew/bin/cloudflared (Homebrew).

Tunnel ownership (verified via CF API 2026-07-28): both tunnels (2029fc06-… live, 293ba37a-… dead) live in a different Cloudflare account than FactoryWager (7a470541…) — cfd_tunnel returns 0 tunnels and both IDs 404. The zone CNAMEs point cross-account, which is valid. Deleting the dead tunnel requires that account’s dashboard/credentials — no vault token can do it (all are FactoryWager-account scoped). The ~/.cloudflared/cert.pem origin cert belongs to that other account.

Repo-side template

scripts/cloudflared-reasonix.yml — deleted 2026-07-28 (decommissioned; never installed, DNS never existed, tunnel creation needs the other CF account). Re-create from scratch if the surface is ever wanted.

Gaps / recommended actions

  1. Access policy in front of ledger.factory-wager.com — DONE 2026-07-28 (Access app live; verified 302 to Access login). Also applied same day: score…/portal + project-r-score.pages.dev/portal (302 verified). All staged apps resolved (reasonix decommissioned — see 4).
  2. launchd service for HA — DONE 2026-07-28 (user LaunchAgent com.factorywager.ledger-tunnel; RunAtLoad + KeepAlive; verified running with 3 QUIC connections).
  3. Orphan credential decision — RESOLVED 2026-07-28: 293ba37a-…json was the credential for terminal.factory-wager.com (CNAME deleted). Remaining optional: delete the dead tunnel in the other Cloudflare account’s dashboard and remove the local credential file.
  4. reasonix-serve: install or decommission — DECOMMISSIONED 2026-07-28 (template deleted, Access app dropped, surfaces.reasonix retired).
  5. tunnel:init generator missing — ledger configs cite a generator that does not exist; either restore it or stop claiming provenance.
  6. terminal.factory-wager.com dangling (502) — RESOLVED 2026-07-28: zone CNAME removed; host does not resolve. Not Sports Terminal. Full domain map: docs/brand-alignment.md.

Retirement

Remove when tunnels are centrally managed (dashboard-named tunnels / IaC) and machine-local configs are gone.

Fresh-rerun ls ~/.cloudflared/ && dig +short ledger.factory-wager.com && curl -sI https://ledger.factory-wager.com/ | head -3

This site is open source. Improve this page.