From d719fb69166d17b5fd8cdd8207a9f615eef7b893 Mon Sep 17 00:00:00 2001 From: archivebox Date: Fri, 5 Jun 2026 00:01:10 +0000 Subject: [PATCH] fix(proxy): make tunnel token readable by the cloudflared connector The cloudflared image runs as non-root (uid 65532), so a root-owned 0600 token was unreadable by the connector. chown the token to 65532:65532 and keep 0600; if tunnel-init isn't root (can't chown), fall back to 0644 so it stays readable. --- docker-compose.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index d931d06e..63815899 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -148,7 +148,10 @@ services: desired = {"type": "CNAME", "name": name, "content": target, "proxied": True, "ttl": 1} call("PUT", f"/zones/{zone}/dns_records/{cname[0]['id']}", desired) if cname else call("POST", f"/zones/{zone}/dns_records", desired) tok = call("GET", f"/accounts/{acct}/cfd_tunnel/{tid}/token")["result"] - os.makedirs(os.path.dirname(OUT) or ".", exist_ok=True); open(OUT, "w").write(tok); os.chmod(OUT, 0o600) + os.makedirs(os.path.dirname(OUT) or ".", exist_ok=True) + with open(OUT, "w") as f: f.write(tok) + try: os.chown(OUT, 65532, 65532); os.chmod(OUT, 0o600) # own it by the cloudflared (uid 65532) reader, keep private + except PermissionError: os.chmod(OUT, 0o644) # tunnel-init not root: stay readable to the connector print(f"[tunnel-init] {NAME} ({tid}): *.{DOMAIN} + {DOMAIN} -> {SERVICE}; connector token -> {OUT}") cloudflared: