Cloudflare Worker: Tunnel Broker scaffold and deployment

[AtlantisPleb]

Cloudflare Worker: Tunnel Broker scaffold and deployment

Summary
Set up a Cloudflare Worker in this repo to serve as a tunnel broker. The Worker will mint per-device named Cloudflare Tunnels and DNS, return a connector token + hostname to the desktop, and expose standalone REST endpoints (no client-specific coupling). Follow mcp-lite’s Cloudflare Worker example structure for code layout.

Proposed structure

• worker/
  • src/index.ts – Hono app entrypoint; mounts REST routes and /mcp (later)
  • src/broker/*.ts – broker functions (create/revoke/status, DNS helpers, naming)
  • src/config.ts – env bindings and constants (prefix/suffix, timeouts)
  • wrangler.jsonc – config, compatibility_date, bindings, routes

Endpoints

• POST /tunnels → create tunnel + CNAME; returns { tunnelId, hostname, token, createdAt }
• GET /tunnels/:id/status → connected + route details
• DELETE /tunnels/:id → revoke tunnel + remove DNS

Naming and routing

• Hostname policy: first‑level subdomains tunnel-<rand>.<ZONE> (TLS via Universal SSL)
• Default vars: TUNNEL_HOST_PREFIX=tunnel-, TUNNEL_HOST_SUFFIX=<your-domain>
• Ingress: configure <hostname> -> http://localhost:8787 and catch‑all 404

Security

• Store CF API token and account/zone IDs as Worker secrets: CF_API_TOKEN, CF_ACCOUNT_ID, CF_ZONE_ID
• Shared broker key optional: BROKER_KEY (require for DELETE/GET; POST may be public for one‑command UX)
• Do not log the connector token

Acceptance criteria

• Deployed Worker responds to POST /tunnels with { hostname, token, tunnelId }
• DNS resolves for the minted hostname; TLS handshake succeeds (400/404 is OK for GET /)
• DELETE revokes the tunnel and removes DNS
• Status returns connector state (at least basic connected flag)
• README updated with deploy steps (wrangler), env/secrets, and example curl

Notes

• Use Bun for dependency management and local dev scripts; wrangler for deploy
• Reference: mcp-lite/examples/cloudflare-worker-kv for Worker + Hono project structure

[AtlantisPleb]

Update: Worker scaffolded + config defaults set

• Implemented Hono Worker with MCP endpoint and broker route stubs.
• Added default naming in wrangler config:
  • TUNNEL_HOST_PREFIX=cloudburrow-
  • TUNNEL_HOST_SUFFIX=openagents.com
• Added custom domain route in worker/wrangler.jsonc:
  • routes: cloudburrow-broker.openagents.com/* (zone_name: openagents.com)
• Bun scripts: bun run dev:worker, bun run deploy:worker

Next

• Await account/zone binding + secrets in Cloudflare UI or via wrangler secret put for:
  • CF_API_TOKEN, CF_ACCOUNT_ID, CF_ZONE_ID (and optional BROKER_KEY)
• Implement broker endpoints (POST/GET/DELETE /tunnels) using CF API
• Wire MCP tools to call broker helpers (no token leakage)

[AtlantisPleb]

Status: config + local secrets set; awaiting UI binding

• Updated wrangler defaults: TUNNEL_HOST_PREFIX=cloudburrow-, TUNNEL_HOST_SUFFIX=openagents.com, and added route cloudburrow-broker.openagents.com/*.
• Added worker/.dev.vars locally with CF_ACCOUNT_ID, CF_ZONE_ID, CF_API_TOKEN for dev (file is git-ignored).
• Docs updated with precise UI steps to bind secrets and the custom domain route.

Blocking for deploy

• Need Cloudflare auth to push secrets to the worker (UI or wrangler secret put).
• After binding secrets and deploying once, the route will attach to openagents.com automatically.

Next

• Implement POST/GET/DELETE /tunnels using CF APIs and wire to MCP tools once route is live.

[AtlantisPleb]

Deploy attempt blocked by token permissions

I attempted wrangler deploy using the provided API token via env. The Cloudflare API returned an authentication error when creating the Worker service:

• Error: Authentication error [code: 10000] on /accounts/<account_id>/workers/services/cloudburrow-worker
• Likely cause: API token missing Workers permissions required to deploy scripts.

Required token scopes

• Account → Workers Scripts (Edit)
• Account → Workers Routes (Edit) (for route binding)
• Zone → DNS (Edit), Zone (Read) (for custom domain/route)
• Account → Cloudflare Tunnel (Edit) (for the broker, when we implement it)
• Optional: Account → Workers KV (Edit) if we later add KV adapters

Once the token is updated (or after running wrangler login interactively), I can deploy immediately and the Worker will appear in the UI. The route cloudburrow-broker.openagents.com/* will also attach after deploy.

[AtlantisPleb]

Status: Broker live + endpoints deployed

• Worker deployed; domain resolving via Custom Domain.
• Endpoints implemented and live: POST /tunnels, GET /tunnels/:id/status, DELETE /tunnels/:id.
• Verified: created a named tunnel and DNS CNAME successfully (token not logged). Status initially connected=false until connector runs.
• Defaults: host prefix cloudburrow-, suffix openagents.com.

Next

• (Optional) Add BROKER_KEY secret to require Authorization: Bearer on endpoints.
• Consider adding remote ingress configuration after tunnel creation (so connector tokens don’t need --url).
• Add smoke tests for create→run→status→revoke.

[AtlantisPleb]

Status: E2E verified. Minted tunnel via POST /tunnels, ran cloudflared on desktop, status=connected, and completed WS handshake to wss:///ws. Worker is live at https://cloudburrow-broker.openagents.com (Custom Domain). MCP tools wired to broker. Next: optional BROKER_KEY enforcement, optional ingress config step, and smoke tests.

[AtlantisPleb]

• Broker deployed at https://cloudburrow-broker.openagents.com (custom domain bound)
• Endpoints live: POST /tunnels, GET /tunnels/:id/status, DELETE /tunnels/:id
• Added wrangler quality-of-life scripts:
  • bun run cf:secret:api-token|account-id|zone-id|broker-key
  • root wrangler.toml so wrangler secret put CF_API_TOKEN works from repo root
• Desktop helper now forces HTTP/2 and keeps a single origin keepalive connection; scrubs proxy env vars
• Manual smoke test: minted tunnel, DNS propagated, connector registered (http2); origin reachable when local server is up

[AtlantisPleb]

README updated with current deployment status, usage, and troubleshooting:

• Broker online with custom domain; POST/GET/DELETE endpoints verified.
• MCP endpoint /mcp documented; tools listed.
• Added wrangler secret scripts and clarified config file locations.
• Usage examples for minting a tunnel and running cloudflared with HTTP/2 + minimal keepalive.
  Next: consider adding /tunnels/:id/preflight (edge+DNS ready) and a GET read‑back of ingress to make client flow even simpler.