diff --git a/routeros/cloudflared-bf-public-config.yml b/routeros/cloudflared-bf-public-config.yml
new file mode 100644
index 0000000..c583ef5
--- /dev/null
+++ b/routeros/cloudflared-bf-public-config.yml
@@ -0,0 +1,14 @@
+# cloudflared config for TP31 — Tunnel bf-public on ap1/ap2
+# Device: hAP ax² (arm64), RouterOS container
+# Deploy: als /etc/cloudflared/config.yml im Container (mount via RouterOS)
+# Token liegt in /etc/cloudflared/credentials.json (separater Mount)
+# Der Ingress wird zentral im CF-Dashboard verwaltet (config_src=cloudflare)
+
+tunnel: 48d3b0b6-7233-4781-a76a-1de4a5e957ce
+credentials-file: /etc/cloudflared/credentials.json
+
+# Kein Ingress hier — wird via Dashboard gemanagt (remote config).
+# Kein originRequest nötig — der Ingress definiert das pro Hostname.
+
+metrics: 0.0.0.0:49312
+loglevel: info
diff --git a/routeros/cloudflared/.gitignore b/routeros/cloudflared/.gitignore
new file mode 100644
index 0000000..7684c6e
--- /dev/null
+++ b/routeros/cloudflared/.gitignore
@@ -0,0 +1,2 @@
+# Tunnel-Secret — niemals committen
+credentials.json
diff --git a/routeros/cloudflared/ap-bootstrap.rsc b/routeros/cloudflared/ap-bootstrap.rsc
new file mode 100644
index 0000000..7c51474
--- /dev/null
+++ b/routeros/cloudflared/ap-bootstrap.rsc
@@ -0,0 +1,49 @@
+# RouterOS Container-Bootstrap für cloudflared (TP31, Tunnel bf-public)
+# Auf ap1 UND ap2 identisch ausfuehren — beide sind arm64, gleiche Config.
+#
+# Voraussetzung: device-mode-Wechsel + Reboot durchgefuehrt,
+# container-Paket enabled, veth-Interface existiert.
+# VOR dem Import: /system backup (jeder AP einzeln)
+#
+# Token: BF_PUBLIC_TUNNEL_TOKEN in ~/.secrets/credentials.env
+# Ingress: Dashboard-managed (config_src=cloudflare) — kein local config.yml noetig.
+
+# 1. Dateien auf dem Router ablegen (vor dem Import, via SFTP):
+#    routeros/cloudflared/credentials.json → flash/cloudflared-credentials.json
+#    routeros/cloudflared-bf-public-config.yml → flash/cloudflared-config.yml
+#
+# 2. Dann importieren:
+
+# — DNS fuer den Container ——— (benutzt den Core-Resolver)
+/ip dns set allow-remote-requests=yes servers=10.40.20.36
+
+# — Veth-Interface (Bru cke zum Container, einmalig) ———
+/interface veth add name=veth-cloudflared address=172.17.0.2/30 gateway=172.17.0.1 comment="cloudflared-container"
+# 172.17.0.1 = Host · 172.17.0.2 = Container
+
+# — Source-NAT fuer den Container-Outbound ——— (Core=10.40.99.1)
+/ip firewall nat add chain=srcnat src-address=172.17.0.0/30 out-interface=vlan99 action=masquerade comment="TP31: cloudflared-Outbound"
+
+# — Container-Config ———
+/container config set registry-url=https://ghcr.io ram-high=0 tmpdir=flash/containers
+
+# — Mount: credentials ———
+/container mounts add name=cf-credentials src=flash/cloudflared-credentials.json dst=/etc/cloudflared/credentials.json
+
+# — Mount: config ———
+/container mounts add name=cf-config src=flash/cloudflared-config.yml dst=/etc/cloudflared/config.yml
+
+# — Environment ———
+/container envs add name=cf-env key=TUNNEL_METRICS value=0.0.0.0:49312
+/container envs add name=cf-env key=TUNNEL_LOGLEVEL value=info
+
+# — Container erstellen ———
+/container add remote-image=cloudflare/cloudflared:latest interface=veth-cloudflared root-dir=flash/containers/cf-data mounts=cf-credentials,cf-config envlist=cf-env logging=yes comment="bf-public tunnel (TP31)"
+
+# — Start ———
+/container start 0
+
+# — Abnahme ———
+# /container print (status=started)
+# /log print where message~"cloudflared" (sollte "Registered tunnel connection" zeigen)
+# CF-Dashboard: bf-public Tunnel → connections > 0