firecow_cloudflared

#!/usr/bin/env sh

set -e

# function that prints info message, if TUNNEL_LOGLEVEL is debug or info
printInfo() {
  echo "${TUNNEL_LOGLEVEL}" | grep -q -E '^(debug|info)$' || return 0
  formattedDate=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
  echo "$formattedDate INF ${1}"
}

# function that prints fatal message and exits
printAndExit() {
  formattedDate=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
  echo >&2 "$formattedDate FAT ${2}"
  exit "${1}"
}

if [ -n "${TUNNEL_NAME}" ]; then
  printAndExit 1 "You cannot use TUNNEL_NAME it's derived from TUNNEL_HOSTNAME"
fi

if [ -n "${TUNNEL_FORCE_PROVISIONING_DNS}" ]; then
  printAndExit 1 "You cannot use TUNNEL_FORCE_PROVISIONING_DNS it's determined via route dns command"
fi

if [ -z "${TUNNEL_HOSTNAME}" ]; then
  printAndExit 1 "You need to specify TUNNEL_HOSTNAME"
fi

if [ -z "${TUNNEL_URL}" ] && [ -z "${TUNNEL_UNIX_SOCKET}" ]; then
  printAndExit 1 "You need to specify TUNNEL_URL or TUNNEL_UNIX_SOCKET"
fi

# Make sure TUNNEL_LOGLEVEL is valid
echo "${TUNNEL_LOGLEVEL}" | grep -q -E '^(debug|info|warn|error|fatal)$' || printAndExit $? "TUNNEL_LOGLEVEL must be debug|info|warn|error|fatal"

# Infer tunnel name
derived_tunnel_name=$(echo "${TUNNEL_HOSTNAME}" | sed "s,^.*://,,g" | tr '[:upper:]' '[:lower:]')
unset TUNNEL_HOSTNAME

# Fetch tunnel token
cloudflared --loglevel 'error' tunnel token "${derived_tunnel_name}" > /tmp/creds.json || exit_code=$?
if [ -z "${exit_code}" ]; then
  # Infer tunnel id and place correct cred json file
  tunnel_id=$(base64 -d < /tmp/creds.json | jq -r '.t')
  base64 -d < /tmp/creds.json | jq '.["AccountTag"] = .a | .["TunnelID"] = .t | .["TunnelSecret"] = .s' > /etc/cloudflared/"${tunnel_id}".json
else
  # Create the tunnel
  printInfo "Creating new named tunnel '${derived_tunnel_name}'"
  cloudflared --loglevel 'error' tunnel create "${derived_tunnel_name}" 1>/dev/null

  # Point a DNS record to the tunnel
  printInfo "Routing dns from '${derived_tunnel_name}' to tunnel"
  cloudflared --loglevel 'error' tunnel route dns --overwrite-dns "${derived_tunnel_name}" "${derived_tunnel_name}"

  cloudflared --loglevel 'error' tunnel token "${derived_tunnel_name}" > /tmp/creds.json
  # Infer tunnel id and place correct cred json file
  tunnel_id=$(base64 -d < /tmp/creds.json | jq -r '.t')
  base64 -d < /tmp/creds.json | jq '.["AccountTag"] = .a | .["TunnelID"] = .t | .["TunnelSecret"] = .s' > /etc/cloudflared/"${tunnel_id}".json
fi

# Add config file
cat << EOF > /etc/cloudflared/config.yml
---
tunnel: ${tunnel_id}
credentials-file: /etc/cloudflared/${tunnel_id}.json
ingress:
  - service: ${TUNNEL_URL:-$TUNNEL_UNIX_SOCKET}
EOF

unset TUNNEL_URL
unset TUNNEL_UNIX_SOCKET

exec "cloudflared" "tunnel" "run"