feat: add panel Cloudflare sharing

Author: skulidropek

packages/api/Dockerfile

@@ -34,6 +34,9 @@ RUN set -eu; \
     xvfb libasound2t64 libatk-bridge2.0-0 libatk1.0-0 libcups2 libdrm2 libgbm1 libgtk-3-0 \
     libnss3 libpango-1.0-0 libx11-xcb1 libxcb-dri3-0 libxcomposite1 libxdamage1 libxfixes3 \
     libxkbcommon0 libxrandr2 libxshmfence1 \
+ && curl --location --output /tmp/cloudflared.deb "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-$(dpkg --print-architecture).deb" \
+ && dpkg -i /tmp/cloudflared.deb \
+ && rm -f /tmp/cloudflared.deb \
  && mkdir -p /usr/share/keyrings \
  && curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \
     | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg \

packages/api/src/api/contracts.ts

@@ -74,6 +74,23 @@ export type ProjectPortForwardRequest = {
   readonly hostPort?: number | undefined
 }
 
+export type PanelCloudflareTunnelStatus = "starting" | "running" | "stopped" | "failed"
+
+export type PanelCloudflareTunnelSession = {
+  readonly error: string | null
+  readonly id: string
+  readonly logTail: ReadonlyArray<string>
+  readonly panelUrl: string
+  readonly publicUrl: string | null
+  readonly startedAt: string
+  readonly status: PanelCloudflareTunnelStatus
+  readonly stoppedAt: string | null
+}
+
+export type StartPanelCloudflareTunnelRequest = {
+  readonly panelUrl: string
+}
+
 export type ProjectBrowserStatus = "running" | "stopped" | "missing" | "unknown"
 
 export type ProjectBrowserSession = {

packages/api/src/api/schema.ts

@@ -173,6 +173,10 @@ export const ProjectPortForwardRequestSchema = Schema.Struct({
   targetPort: Schema.Number
 })
 
+export const StartPanelCloudflareTunnelRequestSchema = Schema.Struct({
+  panelUrl: Schema.String
+})
+
 export const ProjectBrowserStatusSchema = Schema.Literal("running", "stopped", "missing", "unknown")
 
 export const ProjectBrowserSessionSchema = Schema.Struct({

packages/api/src/http.ts

@@ -36,6 +36,7 @@ import {
   ProjectPromptUpdateRequestSchema,
   ProjectSkillUpdateRequestSchema,
   StartProjectTerminalSessionRequestSchema,
+  StartPanelCloudflareTunnelRequestSchema,
   StateCommitRequestSchema,
   StateInitRequestSchema,
   StateSyncRequestSchema,
@@ -109,6 +110,11 @@ import {
 import type { ProjectSkillScope } from "./services/project-skills.js"
 import { readProjectBrowserSession, proxyProjectBrowser } from "./services/project-browser.js"
 import { parseProjectBrowserProxyPath } from "./services/project-browser-core.js"
+import {
+  readPanelCloudflareTunnel,
+  startPanelCloudflareTunnel,
+  stopPanelCloudflareTunnel
+} from "./services/panel-cloudflare-tunnel.js"
 import {
   deleteProjectDatabaseForward,
   deleteProjectDatabaseProfile,
@@ -475,6 +481,8 @@ const skillScopeFromBody = (scope: string): ProjectSkillScope | null => {
   }
 }
 const readProjectPortForwardRequest = () => HttpServerRequest.schemaBodyJson(ProjectPortForwardRequestSchema)
+const readStartPanelCloudflareTunnelRequest = () =>
+  HttpServerRequest.schemaBodyJson(StartPanelCloudflareTunnelRequestSchema)
 const readProjectDatabaseProfileRequest = () => HttpServerRequest.schemaBodyJson(ProjectDatabaseProfileRequestSchema)
 const readStateInitRequest = () => HttpServerRequest.schemaBodyJson(StateInitRequestSchema)
 const readStateCommitRequest = () => HttpServerRequest.schemaBodyJson(StateCommitRequestSchema)
@@ -797,6 +805,28 @@ export const makeRouter = () => {
         Effect.flatMap((launch) => jsonResponse({ ok: true, ...launch }, 202)),
         Effect.catchAll(errorResponse)
       )
+    ),
+    HttpRouter.get(
+      "/cloudflare-tunnels/panel",
+      readPanelCloudflareTunnel().pipe(
+        Effect.flatMap((tunnel) => jsonResponse({ tunnel }, 200)),
+        Effect.catchAll(errorResponse)
+      )
+    ),
+    HttpRouter.post(
+      "/cloudflare-tunnels/panel",
+      Effect.gen(function*(_) {
+        const request = yield* _(readStartPanelCloudflareTunnelRequest())
+        const tunnel = yield* _(startPanelCloudflareTunnel(request))
+        return yield* _(jsonResponse({ tunnel }, 202))
+      }).pipe(Effect.catchAll(errorResponse))
+    ),
+    HttpRouter.del(
+      "/cloudflare-tunnels/panel",
+      stopPanelCloudflareTunnel().pipe(
+        Effect.flatMap((tunnel) => jsonResponse({ tunnel }, 200)),
+        Effect.catchAll(errorResponse)
+      )
     )
   )
 

packages/api/src/services/panel-cloudflare-tunnel-core.ts

@@ -0,0 +1,98 @@
+import { existsSync, readFileSync } from "node:fs"
+
+import { parseLinuxDefaultGatewayIp } from "./project-port-proxy-core.js"
+
+export type PanelTunnelTarget =
+  | {
+    readonly ok: true
+    readonly panelUrl: string
+    readonly targetUrl: string
+  }
+  | {
+    readonly ok: false
+    readonly message: string
+  }
+
+const tryCloudflareHostSuffix = ".trycloudflare.com"
+const tryCloudflareUrlPattern = /https:\/\/[a-z0-9-]+\.trycloudflare\.com\b/iu
+
+const stripIpv6Brackets = (value: string): string =>
+  value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value
+
+export const isTryCloudflareHostname = (hostname: string): boolean =>
+  hostname.toLowerCase().endsWith(tryCloudflareHostSuffix)
+
+export const isLocalPanelHostname = (hostname: string): boolean => {
+  const normalized = stripIpv6Brackets(hostname).toLowerCase()
+  return normalized === "localhost" ||
+    normalized === "127.0.0.1" ||
+    normalized === "0.0.0.0" ||
+    normalized === "::1"
+}
+
+export const parseTryCloudflareUrl = (output: string): string | null =>
+  tryCloudflareUrlPattern.exec(output)?.[0] ?? null
+
+const normalizePanelUrl = (value: string): PanelTunnelTarget => {
+  const trimmed = value.trim()
+  if (trimmed.length === 0) {
+    return { ok: false, message: "panelUrl must be a non-empty URL." }
+  }
+
+  try {
+    const url = new URL(trimmed)
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      return { ok: false, message: "panelUrl must use http or https." }
+    }
+    if (isTryCloudflareHostname(url.hostname)) {
+      return { ok: false, message: "Open docker-git locally before starting a new Cloudflare tunnel." }
+    }
+    url.pathname = "/"
+    url.search = ""
+    url.hash = ""
+    return {
+      ok: true,
+      panelUrl: url.toString(),
+      targetUrl: url.toString()
+    }
+  } catch {
+    return { ok: false, message: "panelUrl must be a valid URL." }
+  }
+}
+
+export const resolvePanelTunnelTargetUrl = (
+  panelUrl: string,
+  localhostHost: string
+): PanelTunnelTarget => {
+  const normalized = normalizePanelUrl(panelUrl)
+  if (!normalized.ok) {
+    return normalized
+  }
+
+  const target = new URL(normalized.targetUrl)
+  if (isLocalPanelHostname(target.hostname)) {
+    target.hostname = localhostHost
+  }
+
+  return {
+    ok: true,
+    panelUrl: normalized.panelUrl,
+    targetUrl: target.toString()
+  }
+}
+
+const readDefaultGatewayIp = (): string | null => {
+  try {
+    return parseLinuxDefaultGatewayIp(readFileSync("/proc/net/route", "utf8"))
+  } catch {
+    return null
+  }
+}
+
+export const defaultPanelTunnelLocalhostHost = (): string => {
+  const configured = process.env["DOCKER_GIT_PANEL_TUNNEL_LOCALHOST_HOST"]?.trim()
+  if (configured !== undefined && configured.length > 0) {
+    return configured
+  }
+  return existsSync("/.dockerenv") ? readDefaultGatewayIp() ?? "172.17.0.1" : "127.0.0.1"
+}