Give nodes that asked for it a Cloudflare tunnel

mender-auto-accept/.env.example

@@ -11,3 +11,29 @@ NODE_ID_PREFIX=ret
 
 # Device type for OS artifact matching (optional)
 # DEVICE_TYPE=pi5-v3-arm64
+
+# --- Cloudflare tunnel provisioning (tunnel_sync.py) ---
+
+# Scoped to Account > Cloudflare Tunnel:Edit and Zone > DNS:Edit on retnode.com
+# CLOUDFLARE_API_TOKEN=
+# CLOUDFLARE_ACCOUNT_ID=
+# CLOUDFLARE_ZONE_ID=
+
+# Zone the node hostnames live under
+# REMOTE_ACCESS_DOMAIN=retnode.com
+
+# What the tunnel points at on the node. Leave unset in production.
+# REMOTE_ACCESS_SERVICE=http://localhost:80
+
+# The Access group allowed to reach nodes. Each node's application policy
+# references this id, so no address appears in this repo or on any device, and
+# changing who is in the group applies to the whole fleet at once.
+# Cloudflare One -> Access -> Groups, then copy the group id.
+# CLOUDFLARE_ACCESS_GROUP_ID=
+
+# Your Cloudflare Zero Trust team domain, sent to each node so it can verify
+# the assertions Access signs. e.g. yourteam.cloudflareaccess.com
+# CLOUDFLARE_ACCESS_TEAM_DOMAIN=
+
+# Where tunnel_sync records what it has provisioned (optional).
+# TUNNEL_STATE_FILE=

mender-auto-accept/systemd/retina-tunnel-sync.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Give nodes that asked for it a Cloudflare tunnel
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+# --apply, not --prune. Pruning deletes tunnels and DNS records, so orphans are
+# reported to the journal for a human to look at rather than removed on a timer.
+ExecStart=/root/retina/node-infra/mender-auto-accept/.venv/bin/python /root/retina/node-infra/mender-auto-accept/tunnel_sync.py --apply
+EnvironmentFile=/root/retina/node-infra/mender-auto-accept/.env
+
+# Security hardening
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=no
+PrivateTmp=yes
+# systemd creates /var/lib/retina-tunnel-sync and makes it writable. The state
+# file records which nodes we have provisioned, so it must outlive a deploy:
+# keeping it beside the script put mutable state inside a git checkout, where a
+# pull or a branch change could disturb it. Losing it does not orphan anything
+# (reconciliation finds tunnels by name), but it would make the next pass
+# rebuild state it should simply have known.
+#
+# TUNNEL_STATE_FILE in the EnvironmentFile must point inside this directory.
+StateDirectory=retina-tunnel-sync

mender-auto-accept/systemd/retina-tunnel-sync.timer

@@ -0,0 +1,13 @@
+[Unit]
+Description=Run the tunnel sync every 5 minutes
+
+[Timer]
+# Deliberately slower than mender-auto-accept's 30s. Nodes report their intent
+# through Mender inventory, which owl-os polls every 600s, so anything faster
+# than a few minutes only adds API calls without shortening the wait.
+OnBootSec=2min
+OnUnitActiveSec=5min
+AccuracySec=30s
+
+[Install]
+WantedBy=timers.target