proxmox/scripts/cloudflare-tunnels/URL_MAPPING.md

# URL Mapping Guide

## ✅ Correct URLs (No Port Needed)

When using Cloudflare Tunnel, **do not include the port** in the public URL. The tunnel handles port mapping internally.

### Correct Access URLs

| Public URL | Internal Target | Description |
|------------|----------------|-------------|
| `https://ml110-01.d-bis.org/` | `https://192.168.11.10:8006` | Proxmox UI on ml110-01 |
| `https://r630-01.d-bis.org/` | `https://192.168.11.11:8006` | Proxmox UI on r630-01 |
| `https://r630-02.d-bis.org/` | `https://192.168.11.12:8006` | Proxmox UI on r630-02 |

### ❌ Incorrect URLs

**Do NOT use these:**
- ❌ `https://r630-01.d-bis.org:8006/` - Port should not be in public URL
- ❌ `http://r630-01.d-bis.org/` - Must use HTTPS
- ❌ `r630-01.d-bis.org:8006` - Missing protocol and port not needed

## How It Works

```
User Browser
    ↓
https://r630-01.d-bis.org/  (no port)
    ↓
Cloudflare Edge (TLS termination)
    ↓
Cloudflare Tunnel (encrypted)
    ↓
cloudflared agent (VMID 102)
    ↓
https://192.168.11.11:8006  (internal, port specified here)
    ↓
Proxmox UI
```

## Port Configuration

The port (`8006`) is configured in:
- **Tunnel config**: `/etc/cloudflared/tunnel-r630-01.yml`
- **Cloudflare Dashboard**: Tunnel → Configure → Ingress rules

You specify the port in the tunnel configuration, but users access via the hostname **without** the port.

## Testing

```bash
# Correct - no port
curl -I https://r630-01.d-bis.org

# Incorrect - will fail or not route correctly
curl -I https://r630-01.d-bis.org:8006
```

## Summary

- ✅ **Use**: `https://r630-01.d-bis.org/`
- ❌ **Don't use**: `https://r630-01.d-bis.org:8006/`
- 📍 **Routes to**: `https://192.168.11.11:8006` (internal)