From f568494bac336ba8e36e76f3d545445f3f5b8574 Mon Sep 17 00:00:00 2001 From: Isshi0417 Date: Sat, 4 Jul 2026 11:42:54 +0000 Subject: [PATCH] Update section about cloudflare WAN routing --- docs/04_music_streaming_service.md | 36 ++++++++++++++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-) diff --git a/docs/04_music_streaming_service.md b/docs/04_music_streaming_service.md index 6fae7e1..fb7cff5 100644 --- a/docs/04_music_streaming_service.md +++ b/docs/04_music_streaming_service.md @@ -2,7 +2,7 @@ [← Back to Main README](../README.md) -This section covers the deployment of Navidrome music server, mounting cloud storage via Rclone FUSE, container permission fixes, and syncing Spotify music safely. +This section covers the deployment of Navidrome music server, mounting cloud storage via Rclone FUSE, container permission fixes, and secure WAN routing using Cloudflare Tunnels. --- @@ -66,4 +66,36 @@ git rm --cached ansible/rclone.conf git add . git commit -m " Complete deploying Navidrome on media-stream server as a service" git push -u origin main -``` \ No newline at end of file +``` + +## 4. WAN Routing: Secure Access via Cloudlfare Tunnels + +To allow remote streaming (e.g., from Singapore) without opening security holes in my home router, I deployed a Cloudflare Tunnel. + +```mermaid +sequenceDiagram + autonumber + actor Client as Phone / Client (Singapore) + participant CF as Cloudflare Edge + participant VM as media-stream VM (172.30.1.202) + participant Nav as Navidrome Container + + VM->>CF: Outbound Tunnel connection established (cloudflared) + Client->>CF: Access https://music.shooey.xyz + CF->>CF: Verify SSL & security checks + CF->>VM: Route traffic down the open tunnel + VM->>Nav: Forward request to http://localhost:4533 +``` + +### Key Engineering Decisions: + +1. **Zero Inbound Ports:** No port forwarding is configured on the home router. The VM opens an outbound-only connection (cloudflared), making the server completely invisible to public internet port scanners. +2. **Ansible Automation (deploy_tunnel.yml):** I wrote a playbook to install cloudflared via RPM and register the system service. +3. **Ansible Idempotency (creates):** Instead of using a separate stat check, I utilized the creates flag to ensure the registration command only runs if the service file doesn't exist: +```bash +- name: Install cloudflared systemd service + ansible.builtin.command: + cmd: "cloudflared service install {{ vault_cloudflare_token }}" + creates: /etc/systemd/system/cloudflared.service +``` +4. **Cloudflare Published Application Routing:** I configured Cloudflare to route the public subdomain music.shooey.xyz (HTTP) directoly to localhost:4533 via the tunnel. \ No newline at end of file