# RouterOS Container-Bootstrap für cloudflared (TP31, Tunnel bf-public)
# Auf ap1 UND ap2 identisch ausfuehren — beide sind arm64, gleiche Config.
#
# Voraussetzung: device-mode-Wechsel + Reboot durchgefuehrt,
# container-Paket enabled, veth-Interface existiert.
# VOR dem Import: /system backup (jeder AP einzeln)
#
# Token: BF_PUBLIC_TUNNEL_TOKEN in ~/.secrets/credentials.env
# Ingress: Dashboard-managed (config_src=cloudflare) — kein local config.yml noetig.

# 1. Dateien auf dem Router ablegen (vor dem Import, via SFTP):
#    routeros/cloudflared/credentials.json → flash/cloudflared-credentials.json
#    routeros/cloudflared-bf-public-config.yml → flash/cloudflared-config.yml
#
# 2. Dann importieren:

# — DNS fuer den Container ——— (benutzt den Core-Resolver)
/ip dns set allow-remote-requests=yes servers=10.40.20.36

# — Veth-Interface (Bru cke zum Container, einmalig) ———
/interface veth add name=veth-cloudflared address=172.17.0.2/30 gateway=172.17.0.1 comment="cloudflared-container"
# 172.17.0.1 = Host · 172.17.0.2 = Container

# — Source-NAT fuer den Container-Outbound ——— (Core=10.40.99.1)
/ip firewall nat add chain=srcnat src-address=172.17.0.0/30 out-interface=vlan99 action=masquerade comment="TP31: cloudflared-Outbound"

# — Container-Config ———
/container config set registry-url=https://ghcr.io ram-high=0 tmpdir=flash/containers

# — Mount: credentials ———
/container mounts add name=cf-credentials src=flash/cloudflared-credentials.json dst=/etc/cloudflared/credentials.json

# — Mount: config ———
/container mounts add name=cf-config src=flash/cloudflared-config.yml dst=/etc/cloudflared/config.yml

# — Environment ———
/container envs add name=cf-env key=TUNNEL_METRICS value=0.0.0.0:49312
/container envs add name=cf-env key=TUNNEL_LOGLEVEL value=info

# — Container erstellen ———
/container add remote-image=cloudflare/cloudflared:latest interface=veth-cloudflared root-dir=flash/containers/cf-data mounts=cf-credentials,cf-config envlist=cf-env logging=yes comment="bf-public tunnel (TP31)"

# — Start ———
/container start 0

# — Abnahme ———
# /container print (status=started)
# /log print where message~"cloudflared" (sollte "Registered tunnel connection" zeigen)
# CF-Dashboard: bf-public Tunnel → connections > 0