build(compose): read the tunnel token from the environment and expose cloudflared metrics - #81
Merged
Merged
Conversation
… cloudflared metrics The tunnel token was passed on cloudflared's command line, which put it in docker compose ps, docker top, and any crash report. cloudflared reads TUNNEL_TOKEN natively, so the compose service now sets that from the same CLOUDFLARED_TOKEN variable and drops --token from argv. --metrics 0.0.0.0:2000 serves /ready and /metrics on the compose network only (exposed, not published). The image is distroless, so readiness cannot be a container healthcheck; the worker will probe it in a later change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First of the ops tranche. Compose-only plus a docs note; no app code.
docker compose ps,docker top, crash reports) to the TUNNEL_TOKEN environmentvariable, which cloudflared reads natively. The env-file variable name
stays CLOUDFLARED_TOKEN; only the in-container name changes.
--metrics 0.0.0.0:2000serves /ready and /metrics on the compose network(exposed, not published). The image is distroless, so readiness cannot be a
container healthcheck; the worker heartbeat change (3.4) will probe it.
Validated with
docker compose config: command istunnel --no-autoupdate --metrics 0.0.0.0:2000 run, environment carriesTUNNEL_TOKEN, port 2000 exposed.
Deploy:
docker compose up -d --no-deps cloudflaredrecreates only theconnector; expect a few seconds of tunnel downtime while it reconnects.
Verify afterwards with
docker compose exec -T worker wget -qO- http://cloudflared:2000/ready(expects readyConnections > 0) anddocker compose psno longer showing the token.