Tenant cloudflared-tunnels (machine-side cloudflared state, ~/.cloudflared/)
Scope Local tunnels for factory-wager.com hostnames — audited 2026-07-27
Owner human (no repo SSOT; configs are machine-local)
| Tunnel | Hostname | Target | Config file | Status |
|---|---|---|---|---|
accounting-ledger (2029fc06-…) |
ledger.factory-wager.com |
http://127.0.0.1:3000 |
~/.cloudflared/config-ledger.yml |
DNS resolves (Cloudflare proxy); manual run only |
accounting-ledger dev variant |
ledger.factory-wager.com /app/* |
http://127.0.0.1:5173 (Vite) |
~/.cloudflared/config-ledger-dev.yml |
Manual run only |
prometheus (fa7dbf98-…) |
— none (catch-all only) | http://localhost:9090 |
~/.cloudflared/prometheus-config.yml |
No hostname ingress; no DNS route known |
reasonix-serve |
reasonix.factory-wager.com (would be) |
http://localhost:8787 |
scripts/cloudflared-reasonix.yml (repo template) |
Never installed — no credential, no ~/.cloudflared/config.yml, DNS does not resolve |
Both config-ledger.yml headers claim “Generated by bun run tunnel:init” — no such script exists anywhere in the monorepo (grep verified). Origin of those files is unknown.
~/.cloudflared/)| File | Referenced by | Status |
|---|---|---|
2029fc06-5bbf-415e-9fa1-6b7d3f0b1527.json |
config-ledger.yml, config-ledger-dev.yml |
Live (accounting-ledger) |
fa7dbf98-3128-4b8d-9b6e-6e0e7fd2c8e6.json |
prometheus-config.yml |
Live (prometheus tunnel) |
293ba37a-844f-413d-8b40-b9a9f8ae1c2a.json |
nothing | Orphaned — no config references it |
cert.pem |
cloudflared login | Full-account origin cert |
Credential files were left in place; deletion is a human decision.
| Hostname | Resolves |
|---|---|
ledger.factory-wager.com |
Yes — Cloudflare proxy IPs |
terminal.factory-wager.com |
Yes — Cloudflare proxy IPs |
reasonix.factory-wager.com |
No |
No LaunchAgent / LaunchDaemon for cloudflared exists. Tunnels run only when started manually and die on reboot — no auto-start, no HA. Binary: /opt/homebrew/bin/cloudflared (Homebrew).
scripts/cloudflared-reasonix.yml — template only, not installed. Wildcard *.factory-wager.com → https://api.cloudflare.com ingress removed 2026-07-27 (would have shadowed every subdomain if ever installed). Remaining rules: reasonix.factory-wager.com → http://localhost:8787 + catch-all 404.
ledger.factory-wager.com — the ledger endpoint is public through the tunnel; put a Cloudflare Access application in front of it.cloudflared service install (or a LaunchAgent) for accounting-ledger so it survives reboot.293ba37a-…json is unreferenced; identify its tunnel in the dashboard and delete the tunnel + file, or reattach it (human decision).reasonix-serve: install or decommission — either create the tunnel + credential and install the repo template, or delete scripts/cloudflared-reasonix.yml. DNS currently does not resolve.tunnel:init generator missing — ledger configs cite a generator that does not exist; either restore it or stop claiming provenance.Remove when tunnels are centrally managed (dashboard-named tunnels / IaC) and machine-local configs are gone.
Fresh-rerun ls ~/.cloudflared/ && dig +short ledger.factory-wager.com