`deploy/curator-tunnel-finish.sh`

66 lines
#!/bin/bash
# curator-tunnel-finish.sh — run AFTER `cloudflared tunnel login` succeeds.
# Idempotent: creates the wpb-curator tunnel, writes its ingress config, routes
# curator.wallpapersback.com → the tunnel, and installs a persistent LaunchAgent.
# No sudo. Requires ~/.cloudflared/cert.pem (from `cloudflared tunnel login`).
set -euo pipefail

TUNNEL=wpb-curator
HOSTNAME=curator.wallpapersback.com
LOCAL_NGINX=http://127.0.0.1:9916
CFDIR="$HOME/.cloudflared"
PLIST="$HOME/Library/LaunchAgents/com.steve.wpb-curator-tunnel.plist"

[ -f "$CFDIR/cert.pem" ] || { echo "ERROR: $CFDIR/cert.pem missing — run 'cloudflared tunnel login' first."; exit 1; }

# 1. Create the tunnel if it doesn't exist; capture its UUID.
if ! cloudflared tunnel list 2>/dev/null | awk '{print $2}' | grep -qx "$TUNNEL"; then
  echo "→ creating tunnel $TUNNEL"
  cloudflared tunnel create "$TUNNEL"
else
  echo "→ tunnel $TUNNEL already exists"
fi
TID=$(cloudflared tunnel list 2>/dev/null | awk -v n="$TUNNEL" '$2==n{print $1}')
echo "  tunnel id: $TID"
CREDS="$CFDIR/$TID.json"

# 2. Write ingress config.
cat > "$CFDIR/config.yml" <<YAML
tunnel: $TID
credentials-file: $CREDS
ingress:
  - hostname: $HOSTNAME
    service: $LOCAL_NGINX
  - service: http_status:404
YAML
echo "→ wrote $CFDIR/config.yml"

# 3. Route the hostname to this tunnel (creates the proxied CNAME in the CF zone).
cloudflared tunnel route dns "$TUNNEL" "$HOSTNAME" 2>&1 | sed 's/^/  /' || true

# 4. Persistent LaunchAgent (auto-respawn, survives reboot/login).
cat > "$PLIST" <<PLISTEOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>com.steve.wpb-curator-tunnel</string>
  <key>ProgramArguments</key>
  <array>
    <string>$(command -v cloudflared)</string>
    <string>tunnel</string><string>--config</string><string>$CFDIR/config.yml</string>
    <string>run</string><string>$TUNNEL</string>
  </array>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><true/>
  <key>StandardOutPath</key><string>$HOME/Library/Logs/wpb-curator-tunnel.log</string>
  <key>StandardErrorPath</key><string>$HOME/Library/Logs/wpb-curator-tunnel.log</string>
</dict></plist>
PLISTEOF
echo "→ wrote $PLIST"

launchctl bootout "gui/$(id -u)/com.steve.wpb-curator-tunnel" 2>/dev/null || true
launchctl bootstrap "gui/$(id -u)" "$PLIST"
launchctl kickstart -k "gui/$(id -u)/com.steve.wpb-curator-tunnel" 2>/dev/null || true
echo "✓ tunnel service installed + started. Log: ~/Library/Logs/wpb-curator-tunnel.log"
echo "  (curator.wallpapersback.com resolves only after the GoDaddy→Cloudflare NS cutover.)"