Paul Payne
a3b3339254
Port Castle's tunnel config generator to Go. Central can now manage cloudflared ingress configuration for public service exposure. Services with reach=public get projected at <subdomain>.<publicDomain> with Host/SNI rewriting to the internal domain so the gateway's wildcard cert validates and existing routing works unchanged. - Locally-managed config.yml (not remotely-managed token tunnel) - Public surface is exactly the set of reach=public services - Auto-removes config when tunnel is disabled or no public services - 7 tests covering basic generation, subdomain override, edge cases Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>