{
  "mode": "offline-plan-only",
  "hostname": "relay.sparrowsystems.co",
  "preserve_hostname": "proxy.girl.surgery",
  "origin": "http://127.0.0.1:8080",
  "preflight": [
    "GET /accounts/e27410211c6a179f0e44b647cf688c67/cfd_tunnel?is_deleted=false&name=attested-relay-v2",
    "GET /zones/0b0edf96f88433c25edae95c4694a895/dns_records?name=relay.sparrowsystems.co",
    "Review existing Worker routes, redirects, Access, WAF and cache rules for this hostname."
  ],
  "create_tunnel": {
    "method": "POST",
    "path": "/accounts/e27410211c6a179f0e44b647cf688c67/cfd_tunnel",
    "body": {
      "name": "attested-relay-v2",
      "config_src": "cloudflare"
    }
  },
  "tunnel_configuration": {
    "config": {
      "ingress": [
        {
          "hostname": "relay.sparrowsystems.co",
          "path": "^(/relay|/v1/puzzles/index\\.json|/v1/artifacts/(index\\.json|[0-9a-f]{64}\\.(puzzle|record|attestation|bundle)\\.json))$",
          "service": "http://127.0.0.1:8080",
          "originRequest": {
            "connectTimeout": 5,
            "httpHostHeader": "relay.sparrowsystems.co"
          }
        },
        {
          "service": "http_status:404"
        }
      ]
    }
  },
  "cache_bypass_rule": {
    "description": "Attested relay v2: preserve live packet retries and fresh discovery",
    "expression": "(http.host eq \"relay.sparrowsystems.co\")",
    "action": "set_cache_settings",
    "action_parameters": {
      "cache": false
    },
    "enabled": true
  },
  "cache_rule_note": "Append as the last effective matching cache rule; do not replace a zone ruleset.",
  "configure_tunnel": {
    "method": "PUT",
    "path": "/accounts/e27410211c6a179f0e44b647cf688c67/cfd_tunnel/2f2137bf-c07d-41b9-94f0-276947c38dd6/configurations",
    "body": {
      "config": {
        "ingress": [
          {
            "hostname": "relay.sparrowsystems.co",
            "path": "^(/relay|/v1/puzzles/index\\.json|/v1/artifacts/(index\\.json|[0-9a-f]{64}\\.(puzzle|record|attestation|bundle)\\.json))$",
            "service": "http://127.0.0.1:8080",
            "originRequest": {
              "connectTimeout": 5,
              "httpHostHeader": "relay.sparrowsystems.co"
            }
          },
          {
            "service": "http_status:404"
          }
        ]
      }
    },
    "guard": "Only the newly created dedicated tunnel; verify its name and existing ingress first."
  },
  "create_dns_after_preflight": {
    "method": "POST",
    "path": "/zones/0b0edf96f88433c25edae95c4694a895/dns_records",
    "body": {
      "type": "CNAME",
      "name": "relay.sparrowsystems.co",
      "content": "2f2137bf-c07d-41b9-94f0-276947c38dd6.cfargotunnel.com",
      "proxied": true,
      "ttl": 1,
      "comment": "Dedicated attested-relay v2 tunnel; legacy hostname unchanged"
    },
    "guard": "Only if the complete exact-name listing is empty. Never overwrite existing DNS."
  },
  "connector_token_endpoint": "/accounts/e27410211c6a179f0e44b647cf688c67/cfd_tunnel/2f2137bf-c07d-41b9-94f0-276947c38dd6/token"
}