Update main.go

Author: hhftechnology

main.go

@@ -20,20 +20,44 @@ func init() {
 		DisableColors: true,
 		FullTimestamp: true,
 	})
+	// Set log level based on environment variable or default to info
+	logLevel := os.Getenv("LOG_LEVEL")
+	if logLevel != "" {
+		level, err := log.ParseLevel(logLevel)
+		if err == nil {
+			log.SetLevel(level)
+		}
+	}
 }
 
 func main() {
-	// Initialize Cloudflare API client
+	// Validate required environment variables
+	requiredEnvVars := []string{
+		"CLOUDFLARE_API_TOKEN",
+		"CLOUDFLARE_ACCOUNT_ID",
+		"CLOUDFLARE_TUNNEL_ID",
+		"CLOUDFLARE_ZONE_ID",
+		"TRAEFIK_SERVICE_ENDPOINT",
+		"TRAEFIK_API_ENDPOINT",
+	}
+
+	for _, envVar := range requiredEnvVars {
+		if os.Getenv(envVar) == "" {
+			log.Fatalf("Required environment variable %s is not set", envVar)
+		}
+	}
+
 	cf, err := cloudflare.NewWithAPIToken(os.Getenv("CLOUDFLARE_API_TOKEN"))
 	if err != nil {
 		log.Fatal(err)
 	}
 
 	ctx := context.Background()
 
-	// Set up Traefik API client
 	client := resty.New().
-		SetBaseURL(os.Getenv("TRAEFIK_API_ENDPOINT"))
+		SetBaseURL(os.Getenv("TRAEFIK_API_ENDPOINT")).
+		SetTimeout(10 * time.Second).
+		SetRetryCount(3)
 
 	pollCh := pollTraefikRouters(client)
 	var cache []Router
@@ -42,95 +66,108 @@ func main() {
 			log.Fatal(poll.Err)
 		}
 
-		// Skip if no changes to Traefik routers
+		// skip if no changes to traefik routers
 		if reflect.DeepEqual(cache, poll.Routers) {
 			continue
 		}
 
 		log.Info("changes detected")
 
-		// Update the cache
+		// update the cache
 		cache = poll.Routers
 
-		// Collect unique domains from applicable routers
-		uniqueDomains := make(map[string]struct{})
+		ingress := []cloudflare.UnvalidatedIngressRule{}
+
 		for _, r := range poll.Routers {
-			// Filter routers
+			// Only enabled routes
 			if r.Status != "enabled" {
-				continue
-			}
-			if !contains(r.EntryPoints, os.Getenv("TRAEFIK_ENTRYPOINT")) {
+				log.Debugf("Skipping disabled route: %s", r.Rule)
 				continue
 			}
 
-			// Log if router has TLS configured for debugging
-			if r.TLS.CertResolver != "" {
-				log.WithFields(log.Fields{
-					"router": r.ServiceName,
-					"rule":   r.Rule,
-				}).Warn("router has TLS configured but is included for tunnel")
+			// Handle both HTTP and HTTPS routes
+			// We want to include all routes, including those with TLS configured
+			if os.Getenv("TRAEFIK_ENTRYPOINT") != "" {
+				// If TRAEFIK_ENTRYPOINT is specified, only use routes with that entrypoint
+				if !contains(r.EntryPoints, os.Getenv("TRAEFIK_ENTRYPOINT")) {
+					log.Debugf("Skipping route with different entrypoint: %s", r.Rule)
+					continue
+				}
 			}
 
 			domains, err := http.ParseDomains(r.Rule)
 			if err != nil {
-				log.WithFields(log.Fields{
-					"rule": r.Rule,
-				}).Fatal("failed to parse domains: ", err)
+				log.Errorf("Failed to parse domains from rule %s: %v", r.Rule, err)
+				continue
 			}
+
 			for _, domain := range domains {
-				uniqueDomains[domain] = struct{}{}
+				log.WithFields(log.Fields{
+					"domain":  domain,
+					"service": os.Getenv("TRAEFIK_SERVICE_ENDPOINT"),
+					"tls":     r.TLS.CertResolver != "",
+				}).Info("upserting tunnel")
+
+				ingress = append(ingress, cloudflare.UnvalidatedIngressRule{
+					Hostname: domain,
+					Service:  os.Getenv("TRAEFIK_SERVICE_ENDPOINT"),
+					OriginRequest: &cloudflare.OriginRequestConfig{
+						HTTPHostHeader: &domain,
+						// Add other origin request options if needed
+						NoTLSVerify: boolPtr(true), // Skip TLS verification for internal traffic
+					},
+				})
 			}
 		}
 
-		// Build ingress rules from unique domains
-		ingress := []cloudflare.UnvalidatedIngressRule{}
-		for domain := range uniqueDomains {
-			log.WithFields(log.Fields{
-				"domain":  domain,
-				"service": os.Getenv("TRAEFIK_SERVICE_ENDPOINT"),
-			}).Info("adding ingress rule")
-
-			ingress = append(ingress, cloudflare.UnvalidatedIngressRule{
-				Hostname: domain,
-				Service:  os.Getenv("TRAEFIK_SERVICE_ENDPOINT"),
-				OriginRequest: &cloudflare.OriginRequestConfig{
-					HTTPHostHeader: &domain,
-				},
-			})
-		}
-
-		// Add catch-all rule
+		// add catch-all rule
 		ingress = append(ingress, cloudflare.UnvalidatedIngressRule{
 			Service: "http_status:404",
 		})
 
-		// Update Cloudflare tunnel configuration
 		err = updateTunnels(ctx, cf, ingress)
 		if err != nil {
 			log.Fatal(err)
 		}
 	}
 }
 
-// pollTraefikRouters and updateTunnels remain unchanged but are included for completeness
+// Helper to create a bool pointer
+func boolPtr(b bool) *bool {
+	return &b
+}
+
 func pollTraefikRouters(client *resty.Client) (ch chan PollResponse) {
 	ch = make(chan PollResponse)
 	go func() {
-		defer close(ch)
-		r := rand.New(rand.NewSource(99))
+		defer func() {
+			close(ch)
+		}()
+		r := rand.New(rand.NewSource(time.Now().UnixNano()))
 		c := time.Tick(10 * time.Second)
 
 		for range c {
 			var pollRes PollResponse
 
-			_, pollRes.Err = client.R().
+			resp, err := client.R().
 				EnableTrace().
 				SetResult(&pollRes.Routers).
 				Get("/api/http/routers")
 
-			if pollRes.Err != nil {
+			pollRes.Err = err
+			if err != nil {
+				log.Errorf("Error polling Traefik API: %v", err)
 				ch <- pollRes
-				break
+				time.Sleep(5 * time.Second) // Wait before retrying
+				continue
+			}
+
+			if resp.StatusCode() != 200 {
+				log.Errorf("Unexpected status code from Traefik API: %d", resp.StatusCode())
+				pollRes.Err = fmt.Errorf("unexpected status code: %d", resp.StatusCode())
+				ch <- pollRes
+				time.Sleep(5 * time.Second) // Wait before retrying
+				continue
 			}
 
 			ch <- pollRes
@@ -143,32 +180,33 @@ func pollTraefikRouters(client *resty.Client) (ch chan PollResponse) {
 }
 
 func updateTunnels(ctx context.Context, cf *cloudflare.API, ingress []cloudflare.UnvalidatedIngressRule) error {
-	// Get current tunnel config
+	// Get Current tunnel config
 	aid := cloudflare.AccountIdentifier(os.Getenv("CLOUDFLARE_ACCOUNT_ID"))
 	cfg, err := cf.GetTunnelConfiguration(ctx, aid, os.Getenv("CLOUDFLARE_TUNNEL_ID"))
 	if err != nil {
-		return fmt.Errorf("unable to pull current tunnel config: %s", err)
+		return fmt.Errorf("unable to pull current tunnel config, %s", err.Error())
 	}
 
 	// Update config with new ingress rules
 	cfg.Config.Ingress = ingress
-	_, err = cf.UpdateTunnelConfiguration(ctx, aid, cloudflare.TunnelConfigurationParams{
+	cfg, err = cf.UpdateTunnelConfiguration(ctx, aid, cloudflare.TunnelConfigurationParams{
 		TunnelID: os.Getenv("CLOUDFLARE_TUNNEL_ID"),
 		Config:   cfg.Config,
 	})
 	if err != nil {
-		return fmt.Errorf("unable to update tunnel config: %s", err)
+		return fmt.Errorf("unable to update tunnel config, %s", err.Error())
 	}
 
 	log.Info("tunnel config updated")
 
-	// Update DNS records
+	// Update DNS to point to new tunnel
 	for _, i := range ingress {
 		if i.Hostname == "" {
 			continue
 		}
 
 		var proxied bool = true
+
 		record := cloudflare.DNSRecord{
 			Type:    "CNAME",
 			Name:    i.Hostname,
@@ -180,7 +218,7 @@ func updateTunnels(ctx context.Context, cf *cloudflare.API, ingress []cloudflare
 		zid := cloudflare.ZoneIdentifier(os.Getenv("CLOUDFLARE_ZONE_ID"))
 		r, _, err := cf.ListDNSRecords(ctx, zid, cloudflare.ListDNSRecordsParams{Name: i.Hostname})
 		if err != nil {
-			return fmt.Errorf("error checking DNS records: %s", err)
+			return fmt.Errorf("err checking DNS records, %s", err.Error())
 		}
 
 		if len(r) == 0 {
@@ -192,7 +230,7 @@ func updateTunnels(ctx context.Context, cf *cloudflare.API, ingress []cloudflare
 				Proxied: record.Proxied,
 			})
 			if err != nil {
-				return fmt.Errorf("unable to create DNS record: %s", err)
+				return fmt.Errorf("unable to create DNS record, %s", err.Error())
 			}
 			log.WithFields(log.Fields{
 				"domain": record.Name,
@@ -202,15 +240,15 @@ func updateTunnels(ctx context.Context, cf *cloudflare.API, ingress []cloudflare
 
 		if r[0].Content != record.Content {
 			_, err = cf.UpdateDNSRecord(ctx, zid, cloudflare.UpdateDNSRecordParams{
-				ID:      r[0].ID, // Use existing record ID
+				ID:      r[0].ID, // Use the actual ID from the retrieved record
 				Name:    record.Name,
 				Type:    record.Type,
 				Content: record.Content,
 				TTL:     record.TTL,
 				Proxied: record.Proxied,
 			})
 			if err != nil {
-				return fmt.Errorf("could not update record for %s: %s", i.Hostname, err)
+				return fmt.Errorf("could not update record for %s, %s", i.Hostname, err)
 			}
 			log.WithFields(log.Fields{
 				"domain": record.Name,