# Cloudflare Tunnel Setup Instructions

## Current Status

You're logged into Cloudflare via browser. Now we need to authenticate the cloudflared service on the Nginx proxy.

## Step-by-Step Setup

### Step 1: Authenticate Cloudflared

SSH to the Nginx proxy and run:

```bash
ssh besuadmin@20.160.58.99
sudo cloudflared tunnel login
```

**What happens:**
1. Command will display a URL like: `https://one.dash.cloudflare.com/...`
2. Open this URL in your browser (while logged into Cloudflare)
3. Click "Authorize" to grant access
4. Authentication will complete automatically

### Step 2: Run Automated Setup

After authentication, run the automated setup:

```bash
/tmp/setup-tunnel-non-interactive.sh
```

**Or manually run the full setup:**

```bash
cd /tmp
./setup-cloudflare-tunnel.sh rpc.d-bis.org
```

### Step 3: Verify Setup

Check tunnel status:

```bash
sudo systemctl status cloudflared
sudo cloudflared tunnel list
curl https://rpc.d-bis.org/health
```

## Quick Command Sequence

```bash
# 1. SSH to Nginx proxy
ssh besuadmin@20.160.58.99

# 2. Authenticate (will show URL - open in browser)
sudo cloudflared tunnel login

# 3. Run automated setup
/tmp/setup-tunnel-non-interactive.sh

# 4. Verify
curl https://rpc.d-bis.org/health
```

## What Gets Created

1. **Tunnel**: `phase1-nginx-proxy`
2. **DNS Record**: `rpc.d-bis.org` → `<tunnel-id>.cfargotunnel.com`
3. **Service**: Cloudflared systemd service (enabled and running)
4. **Configuration**: `/etc/cloudflared/config.yml`

## Troubleshooting

### Already Authenticated
If you see "Already authenticated", skip Step 1 and go directly to Step 2.

### DNS Record Already Exists
The script will update the existing record automatically.

### Service Not Starting
Check logs:
```bash
sudo journalctl -u cloudflared -f
```

### Verify Configuration
```bash
sudo cat /etc/cloudflared/config.yml
sudo cloudflared tunnel list
```

---

**Ready to proceed?** Run the commands above to complete the Cloudflare Tunnel setup.

