# VMID 2400 Setup Complete Summary

**Date**: 2026-01-02  
**Status**: ✅ **CLOUDFLARE TUNNEL & ORIGIN CERT INSTALLED**

---

## ✅ Completed Steps

### 1. Cloudflare Tunnel Installation ✅
- ✅ Cloudflared installed on VMID 2400
- ✅ Tunnel service running and connected
- ✅ Tunnel ID: `26138c21-db00-4a02-95db-ec75c07bda5b`
- ✅ Service enabled (auto-start on boot)

### 2. Cloudflare Origin Certificate ✅
- ✅ Origin Certificate installed: `/etc/nginx/ssl/cloudflare-origin.crt`
- ✅ Private Key installed: `/etc/nginx/ssl/cloudflare-origin.key`
- ✅ Certificate valid for: `*.defi-oracle.io` and `defi-oracle.io`
- ✅ Expiration: January 29, 2040 (14 years)
- ✅ Permissions set correctly (644 for cert, 600 for key)

### 3. Nginx Configuration ✅
- ✅ Nginx installed
- ✅ Configuration created: `/etc/nginx/sites-available/rpc-thirdweb`
- ✅ Site enabled: `/etc/nginx/sites-enabled/rpc-thirdweb`
- ✅ Nginx listening on ports 443 (HTTP RPC) and 8443 (WebSocket RPC)
- ✅ SSL/TLS configured with Cloudflare Origin Certificate
- ✅ Cloudflare IP ranges configured for real IP detection

---

## 📋 Remaining Steps

### Step 1: Configure Tunnel Route in Cloudflare Dashboard

1. **Go to**: https://one.dash.cloudflare.com/
2. **Navigate**: Zero Trust → Networks → Tunnels
3. **Select tunnel**: `26138c21-db00-4a02-95db-ec75c07bda5b`
4. **Click**: Configure → Public Hostname
5. **Add hostname**:
   ```
   Subdomain: rpc.public-0138
   Domain: defi-oracle.io
   Service Type: HTTP
   URL: http://127.0.0.1:8545
   ```
   **Note**: You can use `https://127.0.0.1:443` if you want HTTPS, but HTTP works fine with Origin Certificate.

6. **Save hostname**

### Step 2: Create DNS Records

1. **Go to**: Cloudflare Dashboard → DNS → Records
2. **Select domain**: `defi-oracle.io`
3. **Add first CNAME record (tunnel endpoint)**:
   ```
   Type: CNAME
   Name: rpc.public-0138
   Target: 26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com
   Proxy: 🟠 Proxied (orange cloud)
   TTL: Auto
   ```
   Click **Save**

4. **Add second CNAME record (short alias)**:
   ```
   Type: CNAME
   Name: rpc
   Target: rpc.public-0138.defi-oracle.io
   Proxy: 🟠 Proxied (orange cloud)
   TTL: Auto
   ```
   Click **Save**

**DNS Structure**:
- `rpc.defi-oracle.io` → CNAME → `rpc.public-0138.defi-oracle.io` → CNAME → `26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com`

### Step 3: Verify Besu RPC is Running

```bash
# Check Besu service status
ssh root@192.168.11.10 "pct exec 2400 -- systemctl status besu-rpc"

# If not running, start it
ssh root@192.168.11.10 "pct exec 2400 -- systemctl start besu-rpc"
ssh root@192.168.11.10 "pct exec 2400 -- systemctl enable besu-rpc"
```

### Step 4: Test Endpoints

After DNS propagates (1-2 minutes):

**Test using full FQDN**:
```bash
# Test health endpoint
curl -k https://rpc.public-0138.defi-oracle.io/health

# Test RPC endpoint
curl -k https://rpc.public-0138.defi-oracle.io \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
```

**Test using short alias**:
```bash
# Test health endpoint (short alias)
curl -k https://rpc.defi-oracle.io/health

# Test RPC endpoint (short alias)
curl -k https://rpc.defi-oracle.io \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
```

---

## 🔒 Security Configuration

### Restrict Traffic to *.thirdweb.com

To limit access to only ThirdWeb domains, see:
- **Documentation**: `docs/04-configuration/VMID2400_RESTRICT_THIRDWEB_TRAFFIC.md`
- **Script**: `scripts/configure-cloudflare-waf-thirdweb-rule.sh`

**Recommended**: Use Cloudflare Firewall Rules (Method 1) for best security.

---

## 📝 Quick Reference

| Item | Value |
|------|-------|
| **VMID** | 2400 |
| **IP** | 192.168.11.240 |
| **Hostname** | thirdweb-rpc-1 |
| **FQDN** | rpc.public-0138.defi-oracle.io |
| **Short Alias** | rpc.defi-oracle.io |
| **Tunnel ID** | 26138c21-db00-4a02-95db-ec75c07bda5b |
| **CNAME Target** | 26138c21-db00-4a02-95db-ec75c07bda5b.cfargotunnel.com |
| **DNS Structure** | rpc → rpc.public-0138 → tunnel endpoint |
| **HTTP RPC Port** | 443 (Nginx) → 8545 (Besu) |
| **WebSocket Port** | 8443 (Nginx) → 8546 (Besu) |
| **Certificate** | `/etc/nginx/ssl/cloudflare-origin.crt` |
| **Private Key** | `/etc/nginx/ssl/cloudflare-origin.key` |

---

## ✅ Verification Checklist

- [x] Cloudflared installed and running
- [x] Tunnel connected to Cloudflare
- [x] Origin Certificate installed
- [x] Private Key installed with correct permissions
- [x] Nginx installed and configured
- [x] Nginx listening on ports 443 and 8443
- [ ] Tunnel route configured in Cloudflare Dashboard
- [ ] DNS CNAME records created (rpc.public-0138 → tunnel, rpc → rpc.public-0138)
- [ ] Besu RPC service running
- [ ] Endpoint accessible from external (both rpc.defi-oracle.io and rpc.public-0138.defi-oracle.io)

---

**Last Updated**: 2026-01-02  
**Status**: ✅ **READY FOR DNS AND TUNNEL ROUTE CONFIGURATION**
