---
description: Use this skill when the user asks you to expose a local service (web app, API, dashboard, port) to the internet on a public URL, add or change a tunnel hostname, or edit the Cloudflare Tunnel ingress.
---

# Cloudflare Tunnel (pre-provisioned)

A Cloudflare Tunnel is already set up for you. You do NOT run `cloudflared tunnel login`, `create`, `delete`, or `route dns`, and you do NOT touch the credentials JSON.

## What you own

- **Config file**: `~/.visionclaw/profiles/default/tunnel/config.yml` (replace `default` if needed).
- **Your wildcard**: `*.<tunnelname>.visionclawobs.com` — any label is already DNS-routed to your tunnel.
- **Your tunnel name**: the first label of the existing `*.visionclawobs.com` hostname inside `config.yml`.

The apex `<tunnelname>.visionclawobs.com` is reserved for the obs console — leave that ingress rule alone.

## Expose a new local service

1. Append an ingress rule for your new subdomain **above** the catch-all `http_status:404` (must stay last):
   ```yaml
   ingress:
     - hostname: jessica.visionclawobs.com          # existing — do not touch
       service: http://localhost:3101
     - hostname: app.jessica.visionclawobs.com      # new
       service: http://localhost:8080
     - service: http_status:404                     # keep LAST
   ```
2. Make sure the local service is actually running on the port you referenced. If it relies on `pm2`, confirm via `pm2 list` before moving on.
3. Notify the user of the new URL and tell them you are about to restart to apply it (a restart blips every channel for ~10–15 seconds, so don't do this in the middle of a critical task — finish or pause first).
4. Call the `upgrade` tool with `restart_only=true`. This ends the current turn: VisionClaw shuts down gracefully, the process manager brings it back up, and the new cloudflared process reads the updated ingress at startup. **Do not attempt to `curl` the new hostname in the same turn** — the old cloudflared is still running until shutdown fires, so the check would be meaningless, and the turn will be terminated mid-flight anyway.
5. If you want to confirm the hostname is serving after you wake up again (e.g. because the user asks, or on the next heartbeat), run `curl -sI https://app.jessica.visionclawobs.com` then.

## Rules

- Only edit the `config.yml` above; `~/.cloudflared/` is legacy, leave it.
- Stay inside `*.<tunnelname>.visionclawobs.com`.
- Never `pkill cloudflared`, spawn cloudflared yourself, or touch pm2 — `upgrade(restart_only=true)` is the only supported reload path.
- If something looks fundamentally broken (tunnel down, apex not resolving, need a brand new tunnel), report it via `notify_user` instead of trying to re-provision.
