Uh oh!
There was an error while loading. Please reload this page.
fix(tunnel): add --overwrite-dns to obol tunnel login/setup - #471
Merged
Conversation
Re-running `obol tunnel login` or `obol tunnel setup --management local` against a hostname that already has an A/AAAA/CNAME record fails with: cloudflared tunnel route dns failed: exit status 1 Failed to add route: code: 1003, reason: Failed to create record inference.example.com with err An A, AAAA, or CNAME record with that host already exists. cloudflared has supported `--overwrite-dns` on `tunnel route dns` for years for exactly this case (also exposed as `TUNNEL_FORCE_PROVISIONING_DNS`) but the obol wrapper never passed it. Operators hit this whenever they: - Retry a wizard run after fixing an earlier failure. - Move an existing hostname over to a new in-cluster tunnel (cluster re-created, new petname, same DNS target intended). Changes: - internal/tunnel/login.go: add `OverwriteDNS bool` to LoginOptions and pass `--overwrite-dns` through a new `routeDNSArgs` helper. When the caller did not opt in and cloudflared returns the "record already exists" error, append a hint pointing at --overwrite-dns. - internal/tunnel/domain_setup.go: add the same field to SetupOptions and forward it into the Login call in local-managed mode. Remote mode is unaffected because the Cloudflare API path already upserts. - cmd/obol/tunnel_domain.go: expose `--overwrite-dns` on `obol tunnel login` and `obol tunnel setup`. - Default stays false — the user has to opt in. The flag is genuinely destructive (you may flatten a CNAME that someone else placed), so surfacing it as a hint when the conflict happens is the right ergonomic shape. Test plan: - `go test ./internal/tunnel -run TestRouteDNSArgs` passes both default and overwrite cases. - Manual: confirmed end-to-end on spark2 — the prior CNAME for `inference.v1337.org` was replaced when the wizard was re-run after the cluster was recreated.
bussyjd
commented
May 12, 2026
ContributorAuthor
SummaryWhat changed: Why it matters: Risk level: low Commit under test: tip of Base branch: main Scope
ValidationCI checks:
Unit tests: Integration tests: Flow tests:
Release smoke: Live Chain Evidencen/a — this PR is CLI plumbing; no on-chain side effects. Runtime EvidenceQA environment:
Images: n/a Kubernetes / stack:
Model and routing: n/a Artifacts and logs:
Demo readiness:
Review NotesKnown gaps:
Follow-ups:
Reviewer focus:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-running
obol tunnel login(orobol tunnel setup --management local) against a hostname that already has a DNS record fails with Cloudflare API error 1003:cloudflared has supported
--overwrite-dnsontunnel route dnsfor years (alsoTUNNEL_FORCE_PROVISIONING_DNS) — the obol wrapper just never passed it.This adds the
--overwrite-dnsflag to bothobol tunnel loginandobol tunnel setup, plumbs it throughLoginOptions/SetupOptions, and includes a hint on the existing error path so operators learn about the flag at the moment they need it.Default is off — replacing an existing record is destructive (it could flatten a CNAME placed by someone else), so opt-in is the right shape. Remote-managed mode is unaffected because the Cloudflare API path already upserts.
Operators hit this when
inference.v1337.orgfrom a stale (sacred-magpie) tunnel to a fresh dev-mode (merry-troll) tunnel.Test plan
go test ./internal/tunnel -run TestRouteDNSArgs -count=1— new helper passes both default and overwrite cases.go build ./...clean.obol tunnel login --hostname inference.v1337.org --overwrite-dnsreplaces the existing CNAME and finishes the wizard cleanly.Full report (PR template) added as the first comment.