feat(tunnel): add named tunnel support for custom domains

[mahdiwafy]

Summary

Add support for named tunnels (custom domains) in addition to the existing quick tunnel (). This allows operators to expose VansRouter on their own hostname (e.g., ) instead of a random subdomain.

Changes

1. Dual Auth Modes

• Token mode (): Uses flag, no credentials file needed
• Credentials file mode ( + optional ): Uses tunnel UUID + credentials JSON file (same pattern as host cloudflared)

2. Required Config

• • The custom domain (must have CNAME to proxied)

3. Technical Fixes

• Ingress rules: Added mandatory ingress config mapping hostname → local port (without this, cloudflared exits immediately)
• Argument ordering: and must come BEFORE subcommand (cloudflared v2026.7.3+)
• intentionalKill reset: After , reset the flag so genuine startup failures surface real errors instead of being masked as "cloudflared killed"
• Quick tunnel fix: Also applied the intentionalKill reset to for consistency

4. API Changes

• now returns and correct for named tunnels
• Exported from tunnel index

Verification

Tested end-to-end on production:

• ✅ Tunnel enables successfully via with CLI token
• ✅ Cloudflared registers 4 connections to edge (QUIC)
• ✅ Custom domain () reachable via Cloudflare edge
• ✅ returns 200 OK with valid API key via custom domain
• ✅ Existing domain () still works
• ✅ Both auth modes functional (credentials file mode tested)

Deployment Notes

For production use with credentials file mode:

The credentials file should contain from or Incorrect Usage: flag needs an argument: -cred-file

NAME:
cloudflared tunnel token - Fetch the credentials token for an existing tunnel (by name or UUID) that allows to run it

USAGE:
cloudflared tunnel [tunnel command options] token [subcommand options] TUNNEL

DESCRIPTION:
cloudflared tunnel token will fetch the credentials token for a given tunnel (by its name or UUID), which is then used to run the tunnel. This command fails if the tunnel does not exist or has been deleted. Use the flag cloudflared tunnel token --cred-file /my/path/file.json TUNNEL to output the token to the credentials JSON file. Note: this command only works for Tunnels created since cloudflared version 2022.3.0

TUNNEL COMMAND OPTIONS:
--config value Specifies a config file in YAML format. (default: "/home/mahdiwafy/.cloudflared/config.yml")
--origincert value Path to the certificate generated for your origin when you run cloudflared login. [$TUNNEL_ORIGIN_CERT]
--autoupdate-freq value Autoupdate frequency. Default is 24h0m0s. (default: 24h0m0s)
--no-autoupdate Disable periodic check for updates, restarting the server with the new version. (default: false) [$NO_AUTOUPDATE]
--no-prechecks Skip connectivity pre-checks at startup. (default: false) [$TUNNEL_NO_PRECHECKS]
--metrics value Listen address for metrics reporting. If no address is passed cloudflared will try to bind to [localhost:20241 localhost:20242 localhost:20243 localhost:20244 localhost:20245].
If all are unavailable, a random port will be used. Note that when running cloudflared from an virtual
environment the default address binds to all interfaces, hence, it is important to isolate the host
and virtualized host network stacks from each other (default: "localhost:0") [$TUNNEL_METRICS]
--pidfile value Write the application's PID to this file after first successful connection. [$TUNNEL_PIDFILE]
--loglevel value Application logging level {debug, info, warn, error, fatal}. At debug level cloudflared will log request URL, method, protocol, content length, as well as, all request and response headers. This can expose sensitive information in your logs. (default: "info") [$TUNNEL_LOGLEVEL]
--transport-loglevel value, --proto-loglevel value Transport logging level(previously called protocol logging level) {debug, info, warn, error, fatal} (default: "info") [$TUNNEL_PROTO_LOGLEVEL, $TUNNEL_TRANSPORT_LOGLEVEL]
--logfile value Save application log to this file for reporting issues. [$TUNNEL_LOGFILE]
--log-directory value Save application log to this directory for reporting issues. [$TUNNEL_LOGDIRECTORY]
--trace-output value Name of trace output file, generated when cloudflared stops. [$TUNNEL_TRACE_OUTPUT]
--output value Output format for the logs (default, json) (default: "default") [$TUNNEL_MANAGEMENT_OUTPUT, $TUNNEL_LOG_OUTPUT]

SUBCOMMAND OPTIONS:
--credentials-file value, --cred-file value Filepath at which to read/write the tunnel credentials [$TUNNEL_CRED_FILE]
--help, -h show help (default: false)
.