3605d540da
Replaces fragile batch-based tunnel install with a single PowerShell script (cloudflare/start-tunnel.ps1) that installs cloudflared as a Windows service (admin) or runs as a background process (non-admin), clears stale EventLog registry keys that caused service rollback, and runs a 60-second watchdog that auto-restarts the connector on failure. Hostname changed to aether.thetempleofdoom.com. LAUNCH.bat and pack-usb.bat updated accordingly.
303 lines
12 KiB
PowerShell
303 lines
12 KiB
PowerShell
#Requires -Version 5
|
|
param([string]$Root)
|
|
$ErrorActionPreference = 'Continue'
|
|
$Root = ($Root -replace '\\$','')
|
|
|
|
# --- Config (overridden by tunnel-config.json if present) --------------------
|
|
$TOKEN = 'eyJhIjoiODk1NDc5YWIzNTQwZGFhNmQ2MWFlNzAyYTUxNjQ0NzUiLCJ0IjoiYWFhYzYzMTctMzgyYS00OTM3LTgxY2YtYjM2ZjVkNjZjYTU4IiwicyI6Ik1XRXlaV0ZqTlRndE5XTTRPUzAwT0RCa0xXRTNaR010WkdRNU56UTJZMlJoTmpNMiJ9'
|
|
$HOSTNAME = 'killa.thetempleofdoom.com'
|
|
$ORIGIN = 'http://127.0.0.1:8989'
|
|
$SVC = 'cloudflared'
|
|
$DESTDIR = "$env:ProgramData\AetherForge\bin"
|
|
$LOGDIR = "$Root\data\logs"
|
|
$LOGFILE = "$LOGDIR\tunnel.log"
|
|
$PIDFILE = "$env:ProgramData\AetherForge\tunnel.pid"
|
|
$INTERVAL = 60
|
|
|
|
$cfgPath = Join-Path $PSScriptRoot 'tunnel-config.json'
|
|
if (Test-Path $cfgPath) {
|
|
try {
|
|
$c = Get-Content $cfgPath -Raw | ConvertFrom-Json
|
|
if ($c.tunnel_token) { $TOKEN = $c.tunnel_token }
|
|
if ($c.hostname) { $HOSTNAME = $c.hostname }
|
|
if ($c.origin) { $ORIGIN = $c.origin }
|
|
if ($c.watch_interval_seconds){ $INTERVAL = [int]$c.watch_interval_seconds }
|
|
} catch {}
|
|
}
|
|
|
|
# --- Helpers -----------------------------------------------------------------
|
|
function Log([string]$msg, [string]$tag = 'INFO') {
|
|
$line = '{0} [TUNNEL][{1}] {2}' -f (Get-Date -Format 'HH:mm:ss'), $tag, $msg
|
|
Write-Host $line
|
|
try { Add-Content -LiteralPath $LOGFILE -Value $line -Encoding UTF8 } catch {}
|
|
}
|
|
|
|
function SvcState {
|
|
$q = (& sc.exe query $SVC 2>&1) -join ' '
|
|
if ($q -match '1060|does not exist') { return 'MISSING' }
|
|
if ($q -match 'RUNNING') { return 'RUNNING' }
|
|
if ($q -match 'STOPPED') { return 'STOPPED' }
|
|
return 'UNKNOWN'
|
|
}
|
|
|
|
function IsAdmin {
|
|
([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
|
|
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
|
|
}
|
|
|
|
function HttpGet([string]$url, [int]$sec = 10) {
|
|
try {
|
|
$r = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec $sec
|
|
return [pscustomobject]@{ Ok=$true; Code=[int]$r.StatusCode; Err=$null }
|
|
} catch {
|
|
$code = $null
|
|
if ($_.Exception.Response) { $code = [int]$_.Exception.Response.StatusCode }
|
|
return [pscustomobject]@{ Ok=$false; Code=$code; Err=$_.Exception.Message }
|
|
}
|
|
}
|
|
|
|
# --- Locate cloudflared -------------------------------------------------------
|
|
function FindCloudflared {
|
|
# 1. Already staged in ProgramData
|
|
if (Test-Path "$DESTDIR\cloudflared.exe") { return "$DESTDIR\cloudflared.exe" }
|
|
|
|
New-Item -ItemType Directory -Force -Path $DESTDIR | Out-Null
|
|
|
|
# 2. Bundled next to this script on the USB
|
|
$bundled = Join-Path $PSScriptRoot 'cloudflared.exe'
|
|
if (Test-Path $bundled) {
|
|
Copy-Item $bundled "$DESTDIR\cloudflared.exe" -Force
|
|
return "$DESTDIR\cloudflared.exe"
|
|
}
|
|
|
|
# 3. MSI-installed on this PC
|
|
foreach ($dir in @("$env:ProgramFiles\cloudflare\cloudflared",
|
|
"${env:ProgramFiles(x86)}\cloudflare\cloudflared")) {
|
|
if (Test-Path "$dir\cloudflared.exe") {
|
|
Copy-Item "$dir\cloudflared.exe" "$DESTDIR\cloudflared.exe" -Force
|
|
return "$DESTDIR\cloudflared.exe"
|
|
}
|
|
}
|
|
|
|
# 4. Run the MSI if bundled
|
|
$msi = Join-Path $PSScriptRoot 'cloudflared-windows-amd64.msi'
|
|
if (Test-Path $msi) {
|
|
Log 'Installing cloudflared MSI...' 'SETUP'
|
|
Start-Process msiexec -ArgumentList "/i `"$msi`" /quiet /norestart" -Wait
|
|
Start-Sleep -Seconds 6
|
|
if (Test-Path "$env:ProgramFiles\cloudflare\cloudflared\cloudflared.exe") {
|
|
Copy-Item "$env:ProgramFiles\cloudflare\cloudflared\cloudflared.exe" "$DESTDIR\cloudflared.exe" -Force
|
|
return "$DESTDIR\cloudflared.exe"
|
|
}
|
|
}
|
|
|
|
# 5. Download from GitHub as last resort
|
|
Log 'Downloading cloudflared from GitHub...' 'SETUP'
|
|
try {
|
|
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
|
|
$url = 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe'
|
|
Invoke-WebRequest -Uri $url -OutFile "$DESTDIR\cloudflared.exe" -UseBasicParsing
|
|
if (Test-Path "$DESTDIR\cloudflared.exe") { return "$DESTDIR\cloudflared.exe" }
|
|
} catch { Log "Download failed: $_" 'ERROR' }
|
|
|
|
return $null
|
|
}
|
|
|
|
# =============================================================================
|
|
# MAIN
|
|
# =============================================================================
|
|
New-Item -ItemType Directory -Force -Path $LOGDIR | Out-Null
|
|
New-Item -ItemType Directory -Force -Path $DESTDIR | Out-Null
|
|
|
|
Log "Tunnel setup hostname=$HOSTNAME origin=$ORIGIN" 'SETUP'
|
|
|
|
$CF = FindCloudflared
|
|
if (-not $CF) {
|
|
Log 'Cannot locate cloudflared.exe - tunnel skipped.' 'ERROR'
|
|
exit 1
|
|
}
|
|
Log "Using: $CF" 'SETUP'
|
|
|
|
# --- Install + start as Windows service (admin path) -------------------------
|
|
$asService = $false
|
|
|
|
if (IsAdmin) {
|
|
# Stop and remove any existing service
|
|
if ((SvcState) -ne 'MISSING') {
|
|
Log 'Removing existing cloudflared service...' 'SETUP'
|
|
& net.exe stop $SVC 2>&1 | Out-Null
|
|
Start-Sleep -Seconds 2
|
|
& sc.exe delete $SVC 2>&1 | Out-Null
|
|
Start-Sleep -Seconds 2
|
|
}
|
|
|
|
# Clear stale EventLog registry key left by previous installs.
|
|
# cloudflared rolls back the entire service install if this key already exists.
|
|
$evtKey = 'HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\Cloudflared'
|
|
if (Test-Path $evtKey) {
|
|
Log 'Removing stale EventLog registry key...' 'SETUP'
|
|
Remove-Item -LiteralPath $evtKey -Force -ErrorAction SilentlyContinue
|
|
Start-Sleep -Seconds 1
|
|
}
|
|
|
|
Log 'Installing cloudflared Windows service...' 'SETUP'
|
|
# Capture output without triggering PS NativeCommandError decorations
|
|
$installOut = (& $CF service install $TOKEN 2>&1) -join "`n"
|
|
Log $installOut.Trim() 'SETUP'
|
|
Start-Sleep -Seconds 3
|
|
|
|
Log 'Starting service...' 'SETUP'
|
|
& net.exe start $SVC 2>&1 | Out-Null
|
|
Start-Sleep -Seconds 6
|
|
|
|
if ((SvcState) -eq 'RUNNING') {
|
|
Log 'Service RUNNING' 'OK'
|
|
$asService = $true
|
|
} else {
|
|
Log "Service not RUNNING after install (state=$(SvcState)) - falling back to background process." 'WARN'
|
|
}
|
|
} else {
|
|
Log 'Not running as Administrator.' 'WARN'
|
|
Log 'For a persistent Windows service: right-click LAUNCH.bat > Run as administrator.' 'WARN'
|
|
if ((SvcState) -eq 'RUNNING') {
|
|
Log 'Existing cloudflared service is RUNNING - using it.' 'OK'
|
|
$asService = $true
|
|
}
|
|
}
|
|
|
|
# --- Run directly as background process (non-admin fallback) -----------------
|
|
$bgProc = $null
|
|
if (-not $asService) {
|
|
Log 'Starting cloudflared as background process...' 'SETUP'
|
|
|
|
# Kill leftover from previous run
|
|
if (Test-Path $PIDFILE) {
|
|
$oldpid = [int](Get-Content $PIDFILE -Raw -ErrorAction SilentlyContinue)
|
|
if ($oldpid) { Stop-Process -Id $oldpid -Force -ErrorAction SilentlyContinue }
|
|
}
|
|
|
|
$si = New-Object System.Diagnostics.ProcessStartInfo
|
|
$si.FileName = $CF
|
|
$si.Arguments = "tunnel run --token $TOKEN"
|
|
$si.UseShellExecute = $false
|
|
$si.CreateNoWindow = $true
|
|
|
|
$bgProc = [System.Diagnostics.Process]::Start($si)
|
|
Set-Content -LiteralPath $PIDFILE -Value $bgProc.Id -Encoding ASCII
|
|
Log "cloudflared running (PID $($bgProc.Id))" 'SETUP'
|
|
Start-Sleep -Seconds 5
|
|
}
|
|
|
|
# --- Wait up to 20s for cloudflared to establish connection ------------------
|
|
# NOTE: We do NOT check the public URL here because AetherForge hasn't started
|
|
# yet (LAUNCH.bat starts it after this script returns). A 502 at this stage is
|
|
# normal - it just means the tunnel is connected but origin isn't up yet.
|
|
# The watchdog (below) will report OK once AetherForge is running.
|
|
Log "Giving cloudflared 20s to connect to Cloudflare..." 'SETUP'
|
|
Start-Sleep -Seconds 20
|
|
$finalState = SvcState
|
|
if ($asService) {
|
|
if ($finalState -eq 'RUNNING') {
|
|
Log "Tunnel connector ready (service=$finalState). AetherForge starting next." 'OK'
|
|
} else {
|
|
Log "Service state=$finalState after 20s - may still be connecting." 'WARN'
|
|
}
|
|
} else {
|
|
if ($bgProc -and -not $bgProc.HasExited) {
|
|
Log "Tunnel connector ready (background PID $($bgProc.Id)). AetherForge starting next." 'OK'
|
|
} else {
|
|
Log "cloudflared process exited unexpectedly." 'ERROR'
|
|
}
|
|
}
|
|
Log "Public URL will be live once AetherForge starts: https://$HOSTNAME" 'SETUP'
|
|
|
|
# =============================================================================
|
|
# WATCHDOG - runs forever; auto-restarts cloudflared if it goes down
|
|
# =============================================================================
|
|
Log "Watchdog started: checking every ${INTERVAL}s. Log: $LOGFILE" 'WATCH'
|
|
$fails = 0
|
|
|
|
while ($true) {
|
|
Start-Sleep -Seconds $INTERVAL
|
|
|
|
$svc = SvcState
|
|
$pub = HttpGet "https://$HOSTNAME/" 12
|
|
$procOk = ($bgProc -ne $null) -and (-not $bgProc.HasExited)
|
|
|
|
# In background-process mode the service will always be MISSING - that is fine.
|
|
$connectorOk = ($asService -and $svc -eq 'RUNNING') -or (-not $asService -and $procOk)
|
|
$ok = $pub.Ok -and $connectorOk
|
|
|
|
if ($ok) {
|
|
if ($fails -gt 0) { Log "Recovered after $fails failure(s)." 'OK' }
|
|
else { Log "OK svc=$svc public=HTTP $($pub.Code)" 'WATCH' }
|
|
$fails = 0
|
|
continue
|
|
}
|
|
|
|
$fails++
|
|
$pubLabel = if ($pub.Ok) { "HTTP $($pub.Code)" } else { $pub.Err }
|
|
$connLabel = if ($asService) { "svc=$svc" } else { "proc=$(if($procOk){'alive'}else{'dead'})" }
|
|
Log "DEGRADED #$fails $connLabel public=$pubLabel" 'WARN'
|
|
|
|
if ($asService) {
|
|
# --- Service mode healing ---
|
|
if ($svc -ne 'RUNNING') {
|
|
Log 'Restart: net start cloudflared' 'HEAL'
|
|
& net.exe start $SVC 2>&1 | Out-Null
|
|
Start-Sleep -Seconds 5
|
|
if ((SvcState) -eq 'RUNNING') {
|
|
Log 'Service restarted OK.' 'HEAL'
|
|
$fails = 0
|
|
} elseif ($fails -ge 3 -and (IsAdmin)) {
|
|
Log 'Reinstalling cloudflared service after 3 failures...' 'HEAL'
|
|
& net.exe stop $SVC 2>&1 | Out-Null
|
|
& sc.exe delete $SVC 2>&1 | Out-Null
|
|
Start-Sleep -Seconds 2
|
|
& $CF service install $TOKEN 2>&1 | Out-Null
|
|
Start-Sleep -Seconds 2
|
|
& net.exe start $SVC 2>&1 | Out-Null
|
|
Start-Sleep -Seconds 5
|
|
if ((SvcState) -eq 'RUNNING') {
|
|
Log 'Service reinstalled and RUNNING.' 'HEAL'
|
|
$fails = 0
|
|
} else {
|
|
Log 'Reinstall failed.' 'ERROR'
|
|
}
|
|
}
|
|
} else {
|
|
# Service running but public URL unreachable
|
|
Log "Service OK but public URL unreachable. Check Cloudflare dashboard route and that AetherForge is on port 8989." 'WARN'
|
|
}
|
|
} else {
|
|
# --- Background process mode healing ---
|
|
if ($bgProc -and $bgProc.HasExited) {
|
|
Log "cloudflared process exited - restarting..." 'HEAL'
|
|
$si2 = New-Object System.Diagnostics.ProcessStartInfo
|
|
$si2.FileName = $CF
|
|
$si2.Arguments = "tunnel run --token $TOKEN"
|
|
$si2.UseShellExecute = $false
|
|
$si2.CreateNoWindow = $true
|
|
$bgProc = [System.Diagnostics.Process]::Start($si2)
|
|
Set-Content -LiteralPath $PIDFILE -Value $bgProc.Id -Encoding ASCII
|
|
Log "cloudflared restarted (PID $($bgProc.Id))" 'HEAL'
|
|
$fails = 0
|
|
Start-Sleep -Seconds 8
|
|
} elseif ($fails -ge 3) {
|
|
Log "3 failures, killing and restarting cloudflared..." 'HEAL'
|
|
if ($bgProc -and -not $bgProc.HasExited) { $bgProc.Kill() }
|
|
Start-Sleep -Seconds 2
|
|
$si3 = New-Object System.Diagnostics.ProcessStartInfo
|
|
$si3.FileName = $CF
|
|
$si3.Arguments = "tunnel run --token $TOKEN"
|
|
$si3.UseShellExecute = $false
|
|
$si3.CreateNoWindow = $true
|
|
$bgProc = [System.Diagnostics.Process]::Start($si3)
|
|
Set-Content -LiteralPath $PIDFILE -Value $bgProc.Id -Encoding ASCII
|
|
Log "cloudflared restarted (PID $($bgProc.Id))" 'HEAL'
|
|
$fails = 0
|
|
Start-Sleep -Seconds 8
|
|
}
|
|
}
|
|
}
|