From ad6f35aba842ac8a6400855177fa51393b55b9ce Mon Sep 17 00:00:00 2001
From: Sho Ishida <isshi0417@gmail.com>
Date: Thu, 16 Jul 2026 08:58:56 +0000
Subject: [PATCH] Implement cloudflared tunneling

---
 ansible/my_inventory/group_vars/vms/vars.yml  |  2 +
 ansible/my_inventory/group_vars/vms/vault.yml | 79 +++++++++++--------
 ansible/playbooks/06_cloudflared_setup.yml    | 26 ++++++
 .../templates/cloudflared.service.j2          | 10 +++
 ansible/site.yml                              |  4 +
 5 files changed, 87 insertions(+), 34 deletions(-)
 create mode 100644 ansible/playbooks/06_cloudflared_setup.yml
 create mode 100644 ansible/playbooks/templates/cloudflared.service.j2

diff --git a/ansible/my_inventory/group_vars/vms/vars.yml b/ansible/my_inventory/group_vars/vms/vars.yml
index e7975c7..548e0fd 100644
--- a/ansible/my_inventory/group_vars/vms/vars.yml
+++ b/ansible/my_inventory/group_vars/vms/vars.yml
@@ -6,3 +6,5 @@ rclone_gdrive_token: "{{ vault_rclone_gdrive_token }}"
 
 minecraft_ram_limit: "4G"
 playit_secret_key: "{{ vault_playit_secret_key }}"
+
+cloudflare_token: "{{ vault_cloudflared_token }}"
diff --git a/ansible/my_inventory/group_vars/vms/vault.yml b/ansible/my_inventory/group_vars/vms/vault.yml
index 70fda52..ef35f5b 100644
--- a/ansible/my_inventory/group_vars/vms/vault.yml
+++ b/ansible/my_inventory/group_vars/vms/vault.yml
@@ -1,35 +1,46 @@
 $ANSIBLE_VAULT;1.1;AES256
-63313239663566363338626362363936336461393864353261333064353365663764386431623837
-3264653135343439303961633334396430303138373161650a663137303630323735393431656338
-63303639343537326539396231613737656366633962623763623564623336353336653333343430
-6534396539396133320a353833323066613864393861366237346337663433316636643865653763
-39366233336635376639323038643839636139663439383464646439636664323530643534663837
-64363235336662303364396266613064333630393236396636393532336134363538383236313764
-63313733653634363737633566643932623261626661313138393639646464613363333030613433
-66656237643361653534623234333534353866366432653438313837666364653939666238663463
-63633564393266653633363635333264656264666365383464666132626131626532363162303464
-34393030666361663464643135616231373266643862636431306536316563666666646537326337
-39356134383231653334336635633936376335343333626163633434346337636338663162386233
-37373863646333383863653930323264646236353962313738393736343564383531303733663636
-61353430383362633232636437653566333862386137326263323230343735613934343961363861
-39303664316131363332666536383533376663656432613065373464383262326662383766646366
-33313461383163393133366561613964666434373533656638616137383733356664666335376566
-34613338636662656534643334633765353236386666396161323732343639626366346664633365
-32343563393138313764343633323161353033393332616531303162623034646434666631336263
-30303238326235343832346266303461653666386634313336636164636131303231636164373238
-36306463373432366565643765343038366565653535336435306436653435323766666438313432
-66643931666165383134393030353032646566346636386539333030636564373237393766643065
-33643830393731636665306464396164356530363234633431306262626338303030633632363839
-31383938393434346263376339376439616539353664316438623130663638393236396539346566
-39636163343662333930343732366536663765306336343834343239326234313962366663626361
-36653731376531326335643638333431383435373637313232363238626530643935643935346533
-34663339306461346332373062393066383864376663383030316339643961376435636534323562
-34663461343430626366333666326463663965323333306433343762313638316566386164616135
-36333266623537373363353430343431383766373830396365623664343934343736623730376432
-33346238643536633261613062316534336565303437623739323435336630316335663635323936
-35383734303937643061393331303930363065353237356335346332663761663139363432336663
-63383630623035373266393639373935386161626362316265623731616661393635623764633535
-64653832336335373631363266393030623265653264663837666162653932663031626134646331
-30663631326438366433373163313736333935346136666530313232666161343264663064373163
-33316562386166636438393663336665323030333232666166373365346439656665616563333538
-6537303532653533323062333661343364616465396366393533
+31333666373536626261336632623663303463643731653761623661363763613134303136663130
+6166306431666637343338646263376236373865323532370a386437363866366633616562326263
+38393464393539313733376230663765633336663961636434343430343961306236353038326336
+6163626136623139640a353833653931656533666365666361616163613438323136383530626632
+38393535356638653865326637353330666561356230396564666539303431626136656663393330
+31663733653238653463383136376233326661323533396237653432336132663662666434666630
+30396134613862356636326334616133646339303438303833363935396230616234303464656161
+32393162653761643830633037636232636133376461636165383161666466623465653662353462
+38396434356332356132373036333931653161363065303635653665636135613036326637643636
+37393233376264343631663866303461356361636665333134383063366366356434613630646466
+63316164386234373262623465346162313433626130636163623064383561383237613735383935
+38303465633339356433633766373634393935336363666263336564626361616538303964333932
+34666133303064636138643839663865356435396137336235633036376133633933343766313634
+36323562383636373034626139663739366230663132353065636464376337333233363538366534
+31636331396164383734316436666662353938326662623066666237393033656138323634616461
+32643739663565393236633966326233373062646534643737393035323833333664653762383339
+37366130323635386461306632623030313038633230343461623937643266663063373834376661
+30356562363236373963623033353539363366343937653963303933633832313239343536313632
+65633562666462653164653639663737393263356236306265653132643637616165373265666134
+34396663363634326135306133646633326462636165323034663033356163653736633439303838
+31353661363763633664383432653539636635363132386638643266643564313764346539366361
+65636261626139316232653836356438653836376663646233353230663965343230636334386365
+32363936306630333064383063346537396666326435373861363838303734653133653233343031
+36343430383331353738653237323431646539396364366362663130306166363334626362636531
+64373165656635363238303864633333393938303839663565326261646535663662333435323439
+66303835653263663230376362613063363462336430616538623361323737316163356664303631
+33393166663132633130373237623732363064613064313632333464666537613862386634373262
+31393132366139633765636633333937346262373564383064353332356365336136353732356365
+31333161376237633561356261616633666132636432623931303661613266353534376332653164
+32643262643562326438343133356231656464383863636264666162666262346561626133393933
+35653432376437646136623634316664633132646433656631393435653165356566373431323439
+34373336626134313735613364643939636330373136323362333735346362333662383530303930
+32623366613666326634373765616561666639383265376339653231393739303163313231363165
+61376635346331646635613132613766316631353435373765646636613361336236633533353436
+64653532633231653662383563656366333637373562366234323962323931313131386334633934
+31313138656466363431313332666534383231653561633233303638656236343230613262373634
+64626632643238353534386437643065373965356162383164323030326665353562303464663139
+35333464613565303433366466633265313436316139623834666534383163313831316633383962
+39656338626666656462373364653935343532396165323731313366366335646232636431303863
+36613462343065663334313937336132626431643830346236313933633538623966316366316166
+62653139396261653237636535373562393963363330313763353231653236386531323066333738
+32636437363635626431313531646632303064373163363838303031353531336233333261313765
+38616433616261383462626135633938666430326438393964653433393434393932323161613265
+38613035616233636131353263393263323036376664623461393961353236383863343565656238
+6665
diff --git a/ansible/playbooks/06_cloudflared_setup.yml b/ansible/playbooks/06_cloudflared_setup.yml
new file mode 100644
index 0000000..d15c1fd
--- /dev/null
+++ b/ansible/playbooks/06_cloudflared_setup.yml
@@ -0,0 +1,26 @@
+---
+- name: Setup Cloudflared
+  hosts: portfolio.lab.local
+  gather_facts: true
+
+  tasks:
+    - name: Create cloudflared directory
+      ansible.builtin.file:
+        path: "/home/{{ admin_user }}/containers/cloudflared"
+        state: directory
+        mode: "0755"
+
+    - name: Deploy Cloudflared Systemd Service
+      become: true
+      ansible.builtin.template:
+        src: "./templates/cloudflared.service.j2"
+        dest: "/etc/systemd/system/cloudflared.service"
+        mode: "0644"
+
+    - name: Start and enable Cloudflared service
+      become: true
+      ansible.builtin.systemd_service:
+        name: cloudflared.service
+        state: started
+        enabled: true
+        daemon_reload: true
diff --git a/ansible/playbooks/templates/cloudflared.service.j2 b/ansible/playbooks/templates/cloudflared.service.j2
new file mode 100644
index 0000000..8d4c7e5
--- /dev/null
+++ b/ansible/playbooks/templates/cloudflared.service.j2
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cloudflare Tunnel Agent Container
+After=network-online.target portal.service
+Wants=network-online.target portal.service
+
+[Service]
+Type=simple
+Restart=always
+ExecStartPre=-/usr/bin/podman rm -f cloudflared-tunnel
+ExecStart=/usr/bin/podman run --name cloudflared-tunnel --net=host docker.io/cloudflare/cloudflared:latest tunnel --no-autoupdate run --token {{ cloudflare_token }}
diff --git a/ansible/site.yml b/ansible/site.yml
index 960e950..266ddda 100644
--- a/ansible/site.yml
+++ b/ansible/site.yml
@@ -18,3 +18,7 @@
 - name: Playit.gg Server Setup
   import_playbook: ./playbooks/05_playit_setup.yml
   tags: playit
+
+- name: Cloudflared Tunnel Setup
+  import_playbook: ./playbooks/06_cloudflared_setup.yml
+  tags: cloudflared