# VMID 2400 Tunnel Routing Configuration - Complete

**Date**: 2026-01-04  
**Status**: ✅ **CONFIGURED**  
**Tunnel ID**: `26138c21-db00-4a02-95db-ec75c07bda5b`  
**Domain**: `rpc.public-0138.defi-oracle.io`

---

## ✅ Configuration Complete

### Tunnel Routing

```
https://rpc.public-0138.defi-oracle.io (HTTPS)
    ↓
Cloudflare Edge (SSL Termination)
    ↓
Cloudflare Tunnel (encrypted)
    ↓
cloudflared (VMID 2400)
    ↓
http://127.0.0.1:80 (Nginx on VMID 2400)
    ↓
Nginx Routing:
    ├─ HTTP requests → http://127.0.0.1:8545 (Besu HTTP RPC)
    └─ WebSocket requests → http://127.0.0.1:8546 (Besu WebSocket RPC)
```

### Port Mapping

| Public Endpoint | Protocol | Internal Port | Service |
|----------------|----------|---------------|---------|
| `https://rpc.public-0138.defi-oracle.io` | HTTPS | 8545 | Besu HTTP RPC |
| `wss://rpc.public-0138.defi-oracle.io` | WSS | 8546 | Besu WebSocket RPC |

---

## Configuration Details

### Cloudflare Tunnel Configuration

**Tunnel ID**: `26138c21-db00-4a02-95db-ec75c07bda5b`  
**Status**: ✅ Healthy  
**Location**: VMID 2400 (192.168.11.10)

**Ingress Rules**:
```yaml
ingress:
  - hostname: info.defi-oracle.io
    service: http://127.0.0.1:80
  
  - hostname: rpc.public-0138.defi-oracle.io
    service: http://127.0.0.1:80
    originRequest:
      httpHostHeader: rpc.public-0138.defi-oracle.io
  
  - service: http_status:404
```

### Nginx Configuration

**File**: `/etc/nginx/sites-available/rpc-thirdweb`  
**Status**: ✅ Active and running

**Key Features**:
- Listens on port 80 (HTTP) for Cloudflare tunnel
- Listens on port 443 (HTTPS) for direct connections
- Routes HTTP requests to `127.0.0.1:8545` (Besu HTTP RPC)
- Routes WebSocket requests to `127.0.0.1:8546` (Besu WebSocket RPC)
- Detects WebSocket via `$http_upgrade` header
- Cloudflare Origin Certificate configured for SSL/TLS

### Cloudflare SSL/TLS Settings

**SSL Mode**: `full` ✅  
**Status**: Correctly configured for tunnel connections

---

## Service Status

### ✅ Working Components

- **Cloudflared Service**: ✅ Running on VMID 2400
- **Tunnel Status**: ✅ Healthy
- **Besu RPC**: ✅ Responding on port 8545 (Chain ID: 0x8a / 138)
- **Nginx**: ✅ Running and configured
- **Tunnel Configuration**: ✅ Updated via API

### ⚠️ Known Issue

**SSL Handshake Failure**: Public endpoint `https://rpc.public-0138.defi-oracle.io` is experiencing SSL handshake failures from external clients.

**Possible Causes**:
1. Cloudflare SSL/TLS mode may need adjustment
2. DNS propagation delay
3. Cloudflare edge cache needs refresh

**Resolution Steps**:
1. Verify DNS record is proxied (orange cloud) in Cloudflare dashboard
2. Check Cloudflare SSL/TLS settings (should be "Full" or "Full (strict)")
3. Wait 5-15 minutes for DNS/SSL propagation
4. Clear Cloudflare cache if needed

---

## Testing

### Local Testing (from VMID 2400)

```bash
# Test Besu RPC directly
curl -X POST http://127.0.0.1:8545 \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'
# Expected: {"jsonrpc":"2.0","id":1,"result":"0x8a"}

# Test via Nginx
curl -X POST http://127.0.0.1:80 \
  -H 'Host: rpc.public-0138.defi-oracle.io' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'
```

### Public Testing

```bash
# Test HTTP RPC endpoint
curl -X POST https://rpc.public-0138.defi-oracle.io \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'

# Test WebSocket endpoint (using wscat or similar)
wscat -c wss://rpc.public-0138.defi-oracle.io
```

---

## Architecture Summary

1. **Cloudflare Tunnel**: Handles SSL termination and encrypted connection to origin
2. **Nginx**: Routes traffic based on protocol (HTTP → 8545, WebSocket → 8546)
3. **Besu RPC**: Provides blockchain RPC services on ports 8545 (HTTP) and 8546 (WebSocket)

---

## Maintenance

### Update Tunnel Configuration

```bash
cd /home/intlc/projects/proxmox
bash scripts/update-vmid2400-tunnel-config.sh
```

### Reload Nginx

```bash
ssh root@192.168.11.10 "pct exec 2400 -- nginx -s reload"
```

### Check Tunnel Status

```bash
# Via API
curl -X GET "https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/cfd_tunnel/26138c21-db00-4a02-95db-ec75c07bda5b" \
  -H "Authorization: Bearer ${API_TOKEN}"

# Via cloudflared logs
ssh root@192.168.11.10 "pct exec 2400 -- journalctl -u cloudflared -f"
```

---

## Related Documentation

- [VMID2400_DNS_STRUCTURE.md](/docs/04-configuration/VMID2400_DNS_STRUCTURE.md)
- [THIRDWEB_RPC_CLOUDFLARE_SETUP.md](/docs/04-configuration/THIRDWEB_RPC_CLOUDFLARE_SETUP.md)
- [RPC_THIRDWEB_FIX_COMPLETE.md](RPC_THIRDWEB_FIX_COMPLETE.md)

---

**Last Updated**: 2026-01-04  
**Configuration Status**: ✅ Complete  
**Next Action**: Resolve SSL handshake issue in Cloudflare dashboard
