From 03ac2252f8538af75d58b7cf4ba9007cb48a00f2 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:58:47 +0000
Subject: [PATCH] feat(cloudflare): drop public auth.fuzefront.com tunnel
 route/DNS

FuzeFront now reverse-proxies its Authentik IdP under
app.fuzefront.com/api/auth/idp/* (izzywdev/FuzeFront#247), so the public
auth.fuzefront.com host is no longer needed.

Remove `auth` from `public_vanity_hosts` so the proxied CNAME
(cloudflare_record.vanity) for auth.fuzefront.com is retired. With no DNS
record pointing at the tunnel, auth.fuzefront.com no longer resolves to the
cluster (CF 1033/no-route). The catch-all tunnel ingress rule is unchanged,
so app.fuzefront.com (incl. the new /api/auth/idp/* path) keeps routing to
traefik.kube-system:80. No other *.fuzefront.com routes affected.

Closes #255

Co-authored-by: Israel Weinberg <99821070+izzywdev@users.noreply.github.com>
---
 terraform/contabo/cloudflare.tf | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/terraform/contabo/cloudflare.tf b/terraform/contabo/cloudflare.tf
index c8df9373..8edb8d2e 100644
--- a/terraform/contabo/cloudflare.tf
+++ b/terraform/contabo/cloudflare.tf
@@ -26,12 +26,16 @@ locals {
   # chart sets its Traefik Ingress host to match (className traefik, TLS off,
   # CF terminates edge TLS). Adding a future public host is a one-line edit.
   #
+  # NOTE: `auth` (auth.fuzefront.com) was retired — FuzeFront now hides its
+  # Authentik IdP behind app.fuzefront.com/api/auth/idp/* (reverse-proxied
+  # in-cluster, see izzywdev/FuzeFront#247), so no public IdP host is needed.
+  #
   # `plan` = FuzePlan (plan.fuzefront.com). FuzeFront's portal loads FuzePlan's
   # module-federation remoteEntry.js from here, so it must be public (outside the
   # *.prod Access wildcard); FuzePlan declares its own Traefik Ingress for this
   # host in izzywdev/FuzePlan. Routing to Traefik is via the catch-all ingress
   # rule below — no per-host tunnel rule is needed.
-  public_vanity_hosts = ["app", "auth", "plan"]
+  public_vanity_hosts = ["app", "plan"]
 }
 
 # 32-byte cryptographically random tunnel secret
@@ -97,7 +101,7 @@ resource "cloudflare_record" "prod_wildcard" {
   ttl     = 1
 }
 
-# DNS: public vanity hosts (app/auth.fuzefront.com) → same tunnel, proxied.
+# DNS: public vanity hosts (app.fuzefront.com) → same tunnel, proxied.
 # Proxied so CF terminates TLS at the edge (Universal SSL covers the apex hosts)
 # and the request reaches cloudflared → the matching ingress_rule above → Traefik.
 # These hosts are NOT covered by the *.prod Access wildcard, so they are public.