迁移隧道

COPY --from=docker.io/cloudflare/cloudflared:2026.10.2 \
    /usr/local/bin/cloudflared /usr/local/bin/cloudflared

const TUNNEL_ROOT = "/var/lib/tunnels";
const QUICK_URL = "https://[a-z0-9-]+\\.trycloudflare\\.com";

// Prints "connected" and any quick tunnel URL while cloudflared runs
// and serves requests.
const TUNNEL_STATUS = `${CURRENT}
dir=$1
current "$dir" && kill -0 "$pid" 2>/dev/null || exit 0
if grep -q 'Registered tunnel connection' "$dir/log"
then
    echo connected $(grep -o -m1 -E '${QUICK_URL}' "$dir/log")
fi`;

// Prints the port and URL of each connected quick tunnel.
const LIST = `status=$1
for dir in ${TUNNEL_ROOT}/*/; do
    [ -d "$dir" ] || continue
    set -- $(sh -c "$status" sh "$dir")
    [ "$1" = connected ] && [ -n "$2" ] &&
        echo "$(basename "$dir") $2"
done`;

async function capture(
    container: Container,
    argv: string[],
): Promise<string> {
    const process = await container.exec(argv);
    const output = await process.output();
    return new TextDecoder().decode(output.stdout).trim();
}

export class MySandbox extends DurableObject<Env> {
    // ...

    private async startTunnel(
        port: number,
        args: string[],
        env: Record<string, string> = {},
    ): Promise<string> {
        const dir = `${TUNNEL_ROOT}/${port}`;
        const argv = ["cloudflared", "tunnel", "--no-autoupdate", ...args];
        await stopServer(this.container, dir);
        await startServer(this.container, dir, argv, { env });

        const deadline = Date.now() + 30_000;

        while (Date.now() < deadline) {
            const status = await capture(this.container, [
                "sh",
                "-c",
                TUNNEL_STATUS,
                "sh",
                dir,
            ]);

            if (status.startsWith("connected")) {
                return status.slice("connected".length).trim();
            }

            const log = await serverExited(this.container, dir);

            if (log !== undefined) {
                throw new Error(`cloudflared exited: ${log}`);
            }

            await scheduler.wait(500);
        }

        await stopServer(this.container, dir);
        throw new Error("The tunnel did not connect within 30 seconds");
    }

    async openTunnel(port: number): Promise<string> {
        await this.ensureRunning();
        const url = `http://localhost:${port}`;
        return this.startTunnel(port, ["--url", url]);
    }
}

export class MySandbox extends DurableObject<Env> {
    // ...

    async listTunnels(): Promise<{ port: number; url: string }[]> {
        if (!this.container.running) {
            return [];
        }

        const output = await capture(this.container, [
            "sh",
            "-c",
            LIST,
            "sh",
            TUNNEL_STATUS,
        ]);

        return output
            .split("\n")
            .filter((line) => line !== "")
            .map((line) => {
                const [port, url] = line.split(" ");
                return { port: Number(port), url };
            });
    }

    async closeTunnel(port: number): Promise<void> {
        if (!this.container.running) {
            return;
        }

        await stopServer(this.container, `${TUNNEL_ROOT}/${port}`);
    }
}

type Tunnels = Record<string, { id: string; hostname: string }>;
type TunnelsMeta = Record<
    string,
    { accountId?: string; zoneId?: string; dnsRecordId?: string }
>;
type ApiBody<T> = { result: T; errors: unknown[] };

async function cloudflare<T>(
    env: Env,
    path: string,
    init: RequestInit = {},
): Promise<T> {
    const url = `https://api.cloudflare.com/client/v4${path}`;
    const response = await fetch(url, {
        ...init,
        headers: {
            Authorization: `Bearer ${env.CLOUDFLARE_API_TOKEN}`,
        },
    });
    const body = await response.json<ApiBody<T>>();

    if (!response.ok) {
        const errors = JSON.stringify(body.errors);
        throw new Error(`Cloudflare API: ${errors}`);
    }

    return body.result;
}

export class MySandbox extends DurableObject<Env> {
    // ...

    private async namedTunnel(port: number) {
        const { storage } = this.ctx;
        const tunnels = await storage.get<Tunnels>("tunnels");
        const meta = await storage.get<TunnelsMeta>("tunnels:meta");
        const tunnel = tunnels?.[port];

        return tunnel && { ...tunnel, ...meta?.[port] };
    }

    async resumeTunnel(port: number): Promise<string | undefined> {
        const tunnel = await this.namedTunnel(port);

        if (!tunnel?.accountId) {
            return undefined;
        }

        const { accountId, id } = tunnel;
        const token = await cloudflare<string>(
            this.env,
            `/accounts/${accountId}/cfd_tunnel/${id}/token`,
        );

        await this.ensureRunning();
        // TUNNEL_TOKEN keeps the token out of the process list.
        await this.startTunnel(
            port,
            ["run", "--url", `http://localhost:${port}`],
            { TUNNEL_TOKEN: token },
        );

        return `https://${tunnel.hostname}`;
    }

    async deleteTunnel(port: number): Promise<void> {
        const tunnel = await this.namedTunnel(port);

        if (!tunnel?.accountId) {
            return;
        }

        const { accountId, id, zoneId, dnsRecordId } = tunnel;
        await this.closeTunnel(port);
        await cloudflare(
            this.env,
            `/accounts/${accountId}/cfd_tunnel/${id}`,
            { method: "DELETE" },
        );

        if (zoneId && dnsRecordId) {
            await cloudflare(
                this.env,
                `/zones/${zoneId}/dns_records/${dnsRecordId}`,
                { method: "DELETE" },
            );
        }

        await this.ctx.storage.transaction(async (txn) => {
            const tunnels = (await txn.get<Tunnels>("tunnels")) ?? {};
            const meta =
                (await txn.get<TunnelsMeta>("tunnels:meta")) ?? {};
            delete tunnels[port];
            delete meta[port];
            await txn.put({ tunnels, "tunnels:meta": meta });
        });
    }
}