fix: correct tunnel token env var so cloudflared gets the token #136

Merged

fastie81 merged 1 commit from fix/tunnel-token-var into main

2026-09-06 10:53:41 +12:00

fastie81 commented

2026-09-06 10:53:28 +12:00

Owner

Fixes the production tunnel crash-looping (cloudflared 'Restarting 255' with an empty token).

Root cause: the base docker-compose.yml declared the cloudflared token as:

TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN:-}

but the CI deploy job injects TUNNEL_TOKEN into .env.prod/.env.test. Variable-name mismatch meant the token never reached the container, so cloudflared ran without a token and exited.

Changes:

docker-compose.yml: tunnel now reads ${TUNNEL_TOKEN:-} (matches the secret name, the workflow injector, and the .env.prod placeholder).
.forgejo/workflows/ci.yml: deploy injector also substitutes a CLOUDFLARE_TUNNEL_TOKEN placeholder if one is present, and only skips appending TUNNEL_TOKEN when either truthy var already exists -- robust to either placeholder.

Verified green on branch: test 2m6s, lint 58s, build 2m3s.

Fixes the production tunnel crash-looping (cloudflared 'Restarting 255' with an empty token). Root cause: the base docker-compose.yml declared the cloudflared token as: TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN:-} but the CI deploy job injects TUNNEL_TOKEN into .env.prod/.env.test. Variable-name mismatch meant the token never reached the container, so cloudflared ran without a token and exited. Changes: - docker-compose.yml: tunnel now reads ${TUNNEL_TOKEN:-} (matches the secret name, the workflow injector, and the .env.prod placeholder). - .forgejo/workflows/ci.yml: deploy injector also substitutes a CLOUDFLARE_TUNNEL_TOKEN placeholder if one is present, and only skips appending TUNNEL_TOKEN when either truthy var already exists -- robust to either placeholder. Verified green on branch: test 2m6s, lint 58s, build 2m3s.

fastie81 added 1 commit

2026-09-06 10:53:30 +12:00

fix: correct tunnel token env var (TUNNEL_TOKEN, not CLOUDFLARE_TUNNEL_TOKEN)

CI / test (push) Successful in 2m6s

Details

CI / lint-frontend (push) Successful in 58s

Details

CI / build (push) Successful in 2m3s

Details

CI / deploy (push) Has been skipped

Details

f9c0d3925c

The base docker-compose.yml declared the cloudflared tunnel's token as
TUNNEL_TOKEN= but the CI deploy job injects
TUNNEL_TOKEN into .env.prod/.env.test. The name mismatch left the tunnel
with an empty token, causing cloudflared to crash-loop (Restarting 255) in
production.

- docker-compose.yml: tunnel now reads ${TUNNEL_TOKEN:-} (matches the
  secret name, the workflow injector, and the .env.prod placeholder).
- ci.yml: the deploy injector now also substitutes a CLOUDFLARE_TUNNEL_TOKEN
  placeholder if present, and only skips appending TUNNEL_TOKEN when either
  truthy var already exists -- so the whole pipeline is robust to either
  placeholder.

fastie81 merged commit f2e6704381 into main

2026-09-06 10:53:41 +12:00

fastie81 referenced this pull request from a commit

2026-09-06 10:53:45 +12:00

Merge pull request 'fix: correct tunnel token env var so cloudflared gets the token' (#136) from fix/tunnel-token-var into main