10 files changed, 143 insertions, 0 deletions
diff --git a/roles/cloudflared/handlers/main.yml b/roles/cloudflared/handlers/main.yml
new file mode 100644
index 00000000..69ccaaf5
--- /dev/null
+++ b/roles/cloudflared/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+- name: "Restart cloudflared"
+  become: true
+  ansible.builtin.service:
+    name: "cloudflared"
+    state: "restarted"
diff --git a/roles/cloudflared/meta/argument_specs.yml b/roles/cloudflared/meta/argument_specs.yml
new file mode 100644
index 00000000..f20b75dd
--- /dev/null
+++ b/roles/cloudflared/meta/argument_specs.yml
@@ -0,0 +1,9 @@
+---
+argument_specs:
+  main:
+    options:
+      cloudflared_tunnel_token:
+        type: "str"
+        description: "Cloudflare tunnel token from Zero Trust dashboard"
+        required: false
+        no_log: true
diff --git a/roles/cloudflared/meta/main.yml b/roles/cloudflared/meta/main.yml
new file mode 100644
index 00000000..8842aaa1
--- /dev/null
+++ b/roles/cloudflared/meta/main.yml
@@ -0,0 +1,20 @@
+---
+dependencies: []
+galaxy_info:
+  author: "a14m"
+  description: "Install and configure Cloudflare Tunnel daemon"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "Alpine"
+      versions:
+        - "all"
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/cloudflared/tasks/install-alpine.yml b/roles/cloudflared/tasks/install-alpine.yml
new file mode 100644
index 00000000..28437fc9
--- /dev/null
+++ b/roles/cloudflared/tasks/install-alpine.yml
@@ -0,0 +1,32 @@
+---
+- name: "Check if cloudflared binary exists"
+  ansible.builtin.stat:
+    path: "/usr/local/bin/cloudflared"
+  register: cloudflared_binary
+
+- name: "Download cloudflared binary"
+  become: true
+  ansible.builtin.get_url:
+    url: "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64"
+    dest: "/usr/local/bin/cloudflared"
+    mode: "0755"
+    owner: "root"
+    group: "root"
+  when: not cloudflared_binary.stat.exists
+
+- name: "Deploy cloudflared OpenRC service"
+  become: true
+  ansible.builtin.template:
+    src: "cloudflared.initd.j2"
+    dest: "/etc/init.d/cloudflared"
+    owner: "root"
+    group: "root"
+    mode: "0755"
+  notify: "Restart cloudflared"
+
+- name: "Start and enable cloudflared"
+  become: true
+  ansible.builtin.service:
+    name: "cloudflared"
+    state: "started"
+    enabled: true
diff --git a/roles/cloudflared/tasks/install-archlinux.yml b/roles/cloudflared/tasks/install-archlinux.yml
new file mode 100644
index 00000000..5d122644
--- /dev/null
+++ b/roles/cloudflared/tasks/install-archlinux.yml
@@ -0,0 +1,23 @@
+---
+- name: "Install cloudflared"
+  become: true
+  ansible.builtin.package:
+    name: "cloudflared"
+    state: "present"
+
+- name: "Deploy cloudflared systemd service"
+  become: true
+  ansible.builtin.template:
+    src: "cloudflared.service.j2"
+    dest: "/etc/systemd/system/cloudflared.service"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify: "Restart cloudflared"
+
+- name: "Start and enable cloudflared"
+  become: true
+  ansible.builtin.service:
+    name: "cloudflared"
+    state: "started"
+    enabled: true
diff --git a/roles/cloudflared/tasks/install-debian.yml b/roles/cloudflared/tasks/install-debian.yml
new file mode 100644
index 00000000..5d122644
--- /dev/null
+++ b/roles/cloudflared/tasks/install-debian.yml
@@ -0,0 +1,23 @@
+---
+- name: "Install cloudflared"
+  become: true
+  ansible.builtin.package:
+    name: "cloudflared"
+    state: "present"
+
+- name: "Deploy cloudflared systemd service"
+  become: true
+  ansible.builtin.template:
+    src: "cloudflared.service.j2"
+    dest: "/etc/systemd/system/cloudflared.service"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify: "Restart cloudflared"
+
+- name: "Start and enable cloudflared"
+  become: true
+  ansible.builtin.service:
+    name: "cloudflared"
+    state: "started"
+    enabled: true
diff --git a/roles/cloudflared/tasks/main.yml b/roles/cloudflared/tasks/main.yml
new file mode 100644
index 00000000..e4a3b36e
--- /dev/null
+++ b/roles/cloudflared/tasks/main.yml
@@ -0,0 +1,7 @@
+---
+- name: "Skip if tunnel token not defined"
+  when: cloudflared_tunnel_token is not defined
+  ansible.builtin.meta: end_role
+
+- name: "Include OS-specific installation tasks"
+  ansible.builtin.include_tasks: "install-{{ ansible_facts['os_family'] | lower }}.yml"
diff --git a/roles/cloudflared/templates/cloudflared.initd.j2 b/roles/cloudflared/templates/cloudflared.initd.j2
new file mode 100644
index 00000000..72368c17
--- /dev/null
+++ b/roles/cloudflared/templates/cloudflared.initd.j2
@@ -0,0 +1,10 @@
+#!/sbin/openrc-run
+
+description="Cloudflare Tunnel"
+command="/usr/local/bin/cloudflared"
+command_args="tunnel --no-autoupdate run --token {{ cloudflared_tunnel_token }}"
+command_background=true
+pidfile="/run/cloudflared.pid"
+depend() {
+    need net
+}
diff --git a/roles/cloudflared/templates/cloudflared.service.j2 b/roles/cloudflared/templates/cloudflared.service.j2
new file mode 100644
index 00000000..d88f15ec
--- /dev/null
+++ b/roles/cloudflared/templates/cloudflared.service.j2
@@ -0,0 +1,12 @@
+[Unit]
+Description=Cloudflare Tunnel
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/cloudflared tunnel --no-autoupdate run --token {{ cloudflared_tunnel_token }}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
diff --git a/service.yml b/service.yml
index c35aab6a..ee64d629 100644
--- a/service.yml
+++ b/service.yml
@@ -5,6 +5,7 @@
     - proxy.home.arpa
   roles:
     - role: "caddy"
+    - role: "cloudflared"
 
 - name: "Git configure"
   gather_facts: true