菜单
Use when exposing localhost dev servers to the internet, sharing demos externally, setting up Cloudflare tunnels, or when user says "set up cloudflare", "share my localhost", "expose demos", "tunnel". Also use when Vite shows "host not allowed" errors.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | cloudflare-tunnel |
| description | Use when exposing localhost dev servers to the internet, sharing demos externally, setting up Cloudflare tunnels, or when user says "set up cloudflare", "share my localhost", "expose demos", "tunnel". Also use when Vite shows "host not allowed" errors. |
Expose local dev servers via Cloudflare Tunnel with zero port forwarding, zero firewall config.
digraph tunnel_decision {
"Need to expose localhost?" [shape=diamond];
"cloudflared installed?" [shape=diamond];
"cloudflared authenticated?" [shape=diamond];
"Need stable URL?" [shape=diamond];
"Install cloudflared" [shape=box];
"Run: cloudflared tunnel login" [shape=box];
"Quick tunnel (instant)" [shape=box, style=filled, fillcolor="#33CC66"];
"Named tunnel (permanent URL)" [shape=box, style=filled, fillcolor="#33CC66"];
"Need to expose localhost?" -> "cloudflared installed?" [label="yes"];
"cloudflared installed?" -> "Install cloudflared" [label="no"];
"Install cloudflared" -> "cloudflared authenticated?";
"cloudflared installed?" -> "cloudflared authenticated?" [label="yes"];
"cloudflared authenticated?" -> "Run: cloudflared tunnel login" [label="no"];
"Run: cloudflared tunnel login" -> "Need stable URL?";
"cloudflared authenticated?" -> "Need stable URL?" [label="yes"];
"Need stable URL?" -> "Named tunnel (permanent URL)" [label="yes"];
"Need stable URL?" -> "Quick tunnel (instant)" [label="no"];
}
# Check if installed
cloudflared --version
# Install if missing (Windows)
winget install cloudflare.cloudflared
# Authenticate (opens browser — user must click to authorize)
cloudflared tunnel login
# Verify: ~/.cloudflared/cert.pem exists after auth
CRITICAL: Do this BEFORE starting any tunnel. Vite blocks unknown hostnames by default.
// vite.config.ts — add allowedHosts: true to server block
server: {
port: 5176,
allowedHosts: true, // <-- allows Cloudflare tunnel hostnames
}
Then restart the dev server. The allowedHosts change requires a restart.
cloudflared tunnel --url http://localhost:PORT
abc-def-ghi.trycloudflare.com)Requires: Cloudflare account + domain with Cloudflare nameservers
# Create tunnel
cloudflared tunnel create TUNNEL_NAME
# Route to subdomain (adds CNAME automatically)
cloudflared tunnel route dns TUNNEL_NAME subdomain.yourdomain.com
# Run tunnel
cloudflared tunnel --url http://localhost:PORT run TUNNEL_NAME
Named tunnels require your domain's nameservers to point to Cloudflare. If nameservers are elsewhere (e.g., dotster, GoDaddy), the subdomain won't resolve. Use quick tunnel as fallback.
Cloudflare tells you which nameservers to set. The registrar UI is often buried.
| Registrar | Path to Nameservers |
|---|---|
| Network Solutions | Advanced View → check domain → Actions dropdown → or networksolutions.com/manage-it/edit-nameservers.jsp (old UI, must select domain first) |
| GoDaddy | My Products → DNS → Nameservers → Change |
| Namecheap | Domain List → Manage → Nameservers → Custom DNS |
| Google Domains | DNS → Custom name servers |
If the registrar UI is painful: Use their live chat support and ask them to change nameservers. They can do it instantly.
Propagation: 5 min to 48 hours. Check with nslookup yourdomain.com 1.1.1.1
| Symptom | Fix |
|---|---|
Blocked request. This host is not allowed | Add allowedHosts: true to vite.config.ts server block, restart dev server |
ERR_CONNECTION_RESET on named tunnel URL | DNS hasn't propagated — nameservers still pointing to old registrar. Use quick tunnel. |
You are modifying DNS for these domains: (empty) | Network Solutions bug — domain not selected. Use Advanced View, check domain, then Actions. |
cert.pem not found | Run cloudflared tunnel login and complete browser auth |
| Tunnel running but page blank | Dev server not running on the specified port. Check curl localhost:PORT |
# Install as Windows service (persistent across reboots)
cloudflared service install
# Configure in: C:\Users\USERNAME\.cloudflared\config.yml
# config.yml
tunnel: TUNNEL_ID
credentials-file: C:\Users\USERNAME\.cloudflared\TUNNEL_ID.json
ingress:
- hostname: demos.yourdomain.com
service: http://localhost:5176
- hostname: api.yourdomain.com
service: http://localhost:3000
- service: http_status:404
# config.yml — route multiple subdomains through one tunnel
ingress:
- hostname: demos.guitaralchemist.com
service: http://localhost:5176
- hostname: api.guitaralchemist.com
service: http://localhost:3000
- hostname: dashboard.guitaralchemist.com
service: http://localhost:8080
- service: http_status:404 # catch-all required
Use when a pull request needs review by a different AI model than the one that authored it, or when configuring cross-model code review pipelines in CI/CD.
Run Demerzel's autonomous driver — full cycle or individual phases across all repos
Capture meaningful session state (current cursor, in-flight work, live hypotheses, open questions, do-NOT-carry-forward, success criteria) to state/digests/latest.md so the next session — including one after auto-compaction — can re-enter without re-discovering context cold. Distinct from /learnings (which captures surprises). Validates against docs/contracts/digest-schema.json.
Autonomous research scheduler — selects the most under-researched department by coverage ratio, generates questions from completeness gaps, cross-model validates, auto-produces courses at T>=0.8, rate-limited to 6 cycles/day with kill switch
Personalized AI tutor — turns any topic into a customized, progress-tracked learning course. Use when the user wants to LEARN a concept, skill, language, tool, or domain. Creates a MISSION, curated RESOURCES, iterative lessons with self-checks, and learning-records that persist across sessions. NOT for interrogating the user about their own design (use brainstorming/IDSD for that).
Run one bounded supervised autonomous cycle on the Demerzel governance repo. Picks the smallest unchecked governance slice inside allow_edit, implements it, runs the oracle (`pwsh scripts/verify.ps1`), emits cycle evidence, and stops. Refuses to run unless dev-process-overseer reports loop-eligible and the preflight passes. Use when asked to "run one supervised loop", "advance governance autonomously", or "do one cycle and stop".