@rubytech/create-maxy-code 0.1.0

package/payload/platform/plugins/cloudflare/scripts/setup-tunnel.sh

@@ -0,0 +1,826 @@
+#!/usr/bin/env bash
+# Deterministic Cloudflare tunnel setup — mirrors
+# platform/plugins/cloudflare/references/manual-setup.md step-by-step.
+# Brand-scoped paths, user-space systemd, apex-aware.
+#
+# Usage:
+#   setup-tunnel.sh <brand> <port> <hostname> [<hostname> ...]
+#
+# Example:
+#   setup-tunnel.sh maxy 19200 admin.maxy.bot public.maxy.bot maxy.chat
+#
+# Apex hostnames (exactly two DNS labels) cannot have their CNAMEs created
+# via `cloudflared tunnel route dns` — see manual-setup.md §Step 4 Apex
+# hostnames. The script writes the ingress rule for them but prints an
+# explicit ACTION REQUIRED message naming the manual dashboard step.
+#
+# Step 1 owns the browser-spawn deterministically. The wrapper extracts
+# cloudflared's argotunnel URL from its stdout (regex below) and the moment
+# the URL surfaces, mechanically opens it on the Pi's VNC chromium via
+# `DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} /usr/bin/chromium <url> &` — no reliance on
+# cloudflared's optimistic xdg-open, no CDP auto-click, no DOM matcher.
+# The operator clicks the zone row + Authorize on the VNC themselves.
+# This is the wrappers-faithfully-relay-third-party-cli doctrine (Task 858);
+# any layer that auto-clicks Authorize for the operator is forbidden.
+# cloudflared's stdout+stderr is teed line-by-line into STREAM_LOG_PATH so
+# the chat UI's server-side tailer renders live progress in-turn.
+
+set -euo pipefail
+
+# --------------------------------------------------------------------------
+# Shared stream-log helpers (require STREAM_LOG_PATH, phase_line, …).
+# --------------------------------------------------------------------------
+
+# shellcheck source=_stream-log.sh
+# Resolve symlinks before dirname — ~/setup-tunnel.sh is installed as a symlink
+# (see packages/create-maxy/src/index.ts:installTunnelScripts), so the raw
+# BASH_SOURCE[0] points at $HOME, not the scripts directory where _stream-log.sh lives.
+source "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/_stream-log.sh"
+require_stream_log_path setup-tunnel
+
+# --------------------------------------------------------------------------
+# Args
+# --------------------------------------------------------------------------
+
+if [ "$#" -lt 3 ]; then
+  echo "Usage: $0 <brand> <port> <hostname> [<hostname> ...]" >&2
+  echo "Example: $0 maxy 19200 admin.maxy.bot public.maxy.bot maxy.chat" >&2
+  exit 2
+fi
+
+BRAND="$1"
+PORT="$2"
+shift 2
+HOSTNAMES=("$@")
+
+phase_line setup-tunnel step=start brand="${BRAND}" port="${PORT}" hostnames="${HOSTNAMES[*]}"
+
+# --------------------------------------------------------------------------
+# Step 0: Set brand context (paths + dirs). Corresponds to runbook Step 0.
+# --------------------------------------------------------------------------
+
+CFG_DIR="${HOME}/.${BRAND}/cloudflared"
+mkdir -p "${CFG_DIR}"
+
+# Per-brand X display (Task 553). Each brand owns its own Xtigervnc display
+# so the Chromium tab opened to drive the OAuth Authorize click lands in
+# THIS brand's isolated VNC, not whichever brand booted first on a shared
+# device. Read from the brand manifest if MAXY_PLATFORM_ROOT is exported
+# (set by the systemd unit and by claude-agent::buildSpawnEnv); fall back
+# to the inherited DISPLAY env var, then to :99 for the default brand.
+SETUP_TUNNEL_BRAND_JSON=""
+if [ -n "${MAXY_PLATFORM_ROOT:-}" ] && [ -f "${MAXY_PLATFORM_ROOT}/config/brand.json" ]; then
+  SETUP_TUNNEL_BRAND_JSON="${MAXY_PLATFORM_ROOT}/config/brand.json"
+fi
+BRAND_VNC_DISPLAY=":99"
+if [ -n "${SETUP_TUNNEL_BRAND_JSON}" ] && command -v jq >/dev/null 2>&1; then
+  _bvd=$(jq -r '.vncDisplay // empty' "${SETUP_TUNNEL_BRAND_JSON}" 2>/dev/null || true)
+  if [ -n "${_bvd}" ] && [ "${_bvd}" -eq "${_bvd}" ] 2>/dev/null; then
+    BRAND_VNC_DISPLAY=":${_bvd}"
+  fi
+fi
+
+# Task 929 — read the install-time-resolved non-snap Chromium binary path so
+# the OAuth-URL spawn below uses the same binary vnc.sh's start_chrome runs.
+# Hardcoded `/usr/bin/chromium` would re-introduce the snap-AppArmor failure
+# on Ubuntu Noble laptop. The installer writes this file under platform/config/
+# during installSystemDeps; the spawn at step=browser-spawn fails loud if the
+# file is absent rather than silently falling back to /usr/bin/chromium.
+#
+# Task 957 — four discrete branches (env-unset / file-missing / file-empty /
+# binary-not-executable) so the failure message names the actual condition.
+# Pre-957 the four were conflated into one "cannot resolve a non-snap Chromium
+# binary" message, which masked the env-propagation defect that closed three
+# prior tasks (836, 562, 862) and silently re-fired here.
+if [ -z "${MAXY_PLATFORM_ROOT:-}" ]; then
+  phase_line setup-tunnel step=chromium-resolve result=error reason=env-unset var=MAXY_PLATFORM_ROOT
+  echo "ERROR: setup-tunnel.sh: MAXY_PLATFORM_ROOT is unset in the script's env." >&2
+  echo "       The action runner must declare MAXY_PLATFORM_ROOT in the cloudflare-setup" >&2
+  echo "       whitelist env: block (platform/ui/server/lib/action-runner.ts) — systemd-run --user" >&2
+  echo "       does not inherit the parent process env into the transient unit." >&2
+  exit 1
+fi
+SETUP_TUNNEL_CHROMIUM_PATH_FILE="${MAXY_PLATFORM_ROOT}/config/chromium-binary.path"
+if [ ! -r "${SETUP_TUNNEL_CHROMIUM_PATH_FILE}" ]; then
+  phase_line setup-tunnel step=chromium-resolve result=error reason=path-file-missing path="${SETUP_TUNNEL_CHROMIUM_PATH_FILE}"
+  echo "ERROR: setup-tunnel.sh: chromium-binary.path file is missing or unreadable." >&2
+  echo "       Expected: ${SETUP_TUNNEL_CHROMIUM_PATH_FILE}" >&2
+  echo "       Re-run the installer to provision Chromium." >&2
+  exit 1
+fi
+SETUP_TUNNEL_CHROMIUM_BIN="$(head -n1 "${SETUP_TUNNEL_CHROMIUM_PATH_FILE}" | tr -d '[:space:]')"
+if [ -z "${SETUP_TUNNEL_CHROMIUM_BIN}" ]; then
+  phase_line setup-tunnel step=chromium-resolve result=error reason=path-file-empty path="${SETUP_TUNNEL_CHROMIUM_PATH_FILE}"
+  echo "ERROR: setup-tunnel.sh: chromium-binary.path is empty." >&2
+  echo "       File: ${SETUP_TUNNEL_CHROMIUM_PATH_FILE}" >&2
+  echo "       Re-run the installer to provision Chromium." >&2
+  exit 1
+fi
+if [ ! -x "${SETUP_TUNNEL_CHROMIUM_BIN}" ]; then
+  phase_line setup-tunnel step=chromium-resolve result=error reason=binary-not-executable bin="${SETUP_TUNNEL_CHROMIUM_BIN}" path="${SETUP_TUNNEL_CHROMIUM_PATH_FILE}"
+  echo "ERROR: setup-tunnel.sh: ${SETUP_TUNNEL_CHROMIUM_BIN} is not an executable file." >&2
+  echo "       Resolved from: ${SETUP_TUNNEL_CHROMIUM_PATH_FILE}" >&2
+  echo "       Re-run the installer to provision Chromium." >&2
+  exit 1
+fi
+
+# --------------------------------------------------------------------------
+# Step 1: OAuth login. Corresponds to runbook Step 1.
+#
+# Step 1 is a state machine over two observable variables — brand-scoped
+# cert path and default cert path:
+#
+#   ${CFG_DIR}/cert.pem present                   → Step 1 already done; skip.
+#   ${CFG_DIR}/cert.pem missing                AND
+#     ~/.cloudflared/cert.pem present             → pre-flight: a prior run
+#                                                   reached the OAuth callback
+#                                                   but failed before the mv;
+#                                                   promote and skip cloudflared.
+#   both missing                                  → spawn cloudflared, surface
+#                                                   the URL on the Pi VNC,
+#                                                   wait for the operator's
+#                                                   click, poll for cert.pem,
+#                                                   mv.
+#
+# Control flow when both certs are missing (Task 858 — wrappers faithfully
+# relay third-party CLI):
+#   1. Spawn cloudflared with stdout+stderr teed line-by-line to
+#      $STREAM_LOG_PATH with prefix [script:setup-tunnel:cloudflared]
+#      (Task 605's chat-surface namespace — see _stream-log.sh header).
+#   2. Extract the authorize URL with a tolerant regex as it streams.
+#   3. The instant the URL is extracted, mechanically open it on the Pi
+#      VNC chromium via `DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} /usr/bin/chromium <url> &`.
+#      Fire-and-forget — chromium is already running with CDP enabled at
+#      :9222, so the invocation IPCs the URL into the running instance as
+#      a new tab. The spawn is intentionally NOT tracked in the EXIT trap:
+#      it is a sibling open, not a child of cloudflared, and an orphaned
+#      late-arriving tab is harmless. Replaces cloudflared's own optimistic
+#      xdg-open which does not reliably target VNC :99 in this environment.
+#   4. Emit `step=browser-spawn` and `step=browser-drive mode=operator-click`
+#      so the stream log records the surface state.
+#   5. Wait for ~/.cloudflared/cert.pem to land (180 s budget — operator
+#      must click the zone row + Authorize on VNC).
+#   6. Move cert.pem into the brand-scoped path.
+#
+# No CDP auto-click. No DOM matcher. No consent-page driver of any kind.
+# Every failure branch exits 1 loudly naming the cause.
+# --------------------------------------------------------------------------
+
+# Pre-flight cert-promotion (Task 855). When ${CFG_DIR}/cert.pem is missing
+# but the OAuth-default ~/.cloudflared/cert.pem is present, a prior run
+# reached the cloudflared callback but did not survive to the brand-scoped
+# mv at the end of Step 1. The cert is bound to the account already; the
+# only remediation is the move. Doing it before re-spawning cloudflared is
+# what stops Step 1 from looping forever on a dashboard that has moved past
+# a button-bearing state.
+#
+# The mv exit code is checked: if it fails (EACCES, ENOSPC, weird FS state),
+# loud-fail with reason=cert-promote-failed instead of pretending Step 1
+# succeeded — the next steps would die opaquely on the missing brand cert.
+# stderr is captured into the phase_line so the operator sees the actual
+# failure cause (mv exit-code 1 alone cannot disambiguate EACCES from ENOSPC).
+if [ ! -f "${CFG_DIR}/cert.pem" ] && [ -f "${HOME}/.cloudflared/cert.pem" ]; then
+  MV_ERR="$(mktemp -t maxy-cert-promote-err.XXXXXX)"
+  if mv "${HOME}/.cloudflared/cert.pem" "${CFG_DIR}/cert.pem" 2>"${MV_ERR}"; then
+    rm -f "${MV_ERR}"
+    phase_line setup-tunnel step=oauth-login result=ok \
+      reason=cert-promoted-from-default-path waited="0s"
+  else
+    MV_RC=$?
+    MV_STDERR="$(tr '\n' ' ' < "${MV_ERR}" 2>/dev/null | head -c 200 || echo unavailable)"
+    rm -f "${MV_ERR}"
+    phase_line setup-tunnel step=oauth-login result=error \
+      reason=cert-promote-failed mv_rc="${MV_RC}" stderr="${MV_STDERR}" \
+      from="${HOME}/.cloudflared/cert.pem" to="${CFG_DIR}/cert.pem"
+    echo "ERROR: failed to promote ~/.cloudflared/cert.pem to ${CFG_DIR}/cert.pem (mv exit=${MV_RC})." >&2
+    echo "       mv stderr: ${MV_STDERR}" >&2
+    echo "       Step 1 cannot proceed without the cert in the brand-scoped path." >&2
+    exit 1
+  fi
+fi
+
+if [ ! -f "${CFG_DIR}/cert.pem" ]; then
+  phase_line setup-tunnel step=oauth-login cert_path="${CFG_DIR}/cert.pem" display="${DISPLAY:-${BRAND_VNC_DISPLAY}}"
+
+  URL_FILE="$(mktemp -t maxy-setup-tunnel-url.XXXXXX)"
+  LAST_LINE_FILE="$(mktemp -t maxy-setup-tunnel-last.XXXXXX)"
+  : > "${URL_FILE}"
+  : > "${LAST_LINE_FILE}"
+  # Track the cloudflared pipeline PID so the EXIT trap can kill it on any
+  # failure path — including ones that `exit 1` without an explicit kill.
+  # Missing this trap leaks a cloudflared subshell waiting for the OAuth
+  # callback forever; subsequent setup-tunnel runs see a stale cert.pem
+  # landing asynchronously and race against the new URL-extraction pass.
+  CF_PIPELINE_PID=""
+  CHROMIUM_UNIT=""
+  cleanup_oauth() {
+    [ -n "${CF_PIPELINE_PID}" ] && kill "${CF_PIPELINE_PID}" 2>/dev/null || true
+    # Task 982 — stop the transient chromium unit on any early exit between
+    # browser-spawn and the explicit step=browser-close site below. Best-
+    # effort: no phase_line here because the EXIT trap fires on every path
+    # (including the happy one where step=browser-close already ran and
+    # auto-collected the unit). The `|| true` masks the inevitable "Unit
+    # not loaded" return on the happy path.
+    [ -n "${CHROMIUM_UNIT}" ] && systemctl --user stop "${CHROMIUM_UNIT}" 2>/dev/null || true
+    rm -f "${URL_FILE}" "${LAST_LINE_FILE}"
+  }
+  trap cleanup_oauth EXIT
+
+  # cloudflared is line-buffered (stdbuf), teed to the stream log, URL
+  # extracted as it streams. The subshell holds the whole pipeline so
+  # PIPESTATUS[0] (cloudflared's exit code) is reachable later.
+  (
+    DISPLAY="${DISPLAY:-${BRAND_VNC_DISPLAY}}" stdbuf -oL -eL cloudflared \
+      --origincert "${CFG_DIR}/cert.pem" tunnel login 2>&1 |
+      while IFS= read -r line; do
+        ts="$(stream_log_ts)"
+        printf '[%s] [script:setup-tunnel:cloudflared] %s\n' "${ts}" "${line}" >> "${STREAM_LOG_PATH}"
+        printf '%s\n' "${line}" >&2
+        printf '%s\n' "${line}" > "${LAST_LINE_FILE}"
+        if [ ! -s "${URL_FILE}" ]; then
+          url="$(printf '%s' "${line}" | grep -oE 'https://dash\.cloudflare\.com/argotunnel\?[^ ]+' | head -1 || true)"
+          if [ -n "${url}" ]; then
+            printf '%s' "${url}" > "${URL_FILE}"
+          fi
+        fi
+      done
+  ) &
+  CF_PIPELINE_PID=$!
+
+  # Wait up to ~15s for the URL to surface in cloudflared's output.
+  URL_WAIT=0
+  while [ ! -s "${URL_FILE}" ] && [ "${URL_WAIT}" -lt 30 ]; do
+    if ! kill -0 "${CF_PIPELINE_PID}" 2>/dev/null; then
+      phase_line setup-tunnel step=oauth-login result=error \
+        reason=cloudflared-exited-before-url \
+        last_line="$(cat "${LAST_LINE_FILE}" 2>/dev/null || echo none)"
+      echo "ERROR: cloudflared exited before printing the authorize URL." >&2
+      exit 1
+    fi
+    sleep 0.5
+    URL_WAIT=$((URL_WAIT + 1))
+  done
+
+  if [ ! -s "${URL_FILE}" ]; then
+    kill "${CF_PIPELINE_PID}" 2>/dev/null || true
+    phase_line setup-tunnel step=oauth-login result=error \
+      reason=url-not-extracted waited=15s \
+      last_line="$(cat "${LAST_LINE_FILE}" 2>/dev/null || echo none)"
+    echo "ERROR: cloudflared ran for ~15s without emitting a dash.cloudflare.com/argotunnel URL." >&2
+    echo "       cloudflared output-format may have changed. Check the stream log tail for the raw lines." >&2
+    exit 1
+  fi
+
+  AUTH_URL="$(cat "${URL_FILE}")"
+  phase_line setup-tunnel step=browser-drive url_extracted=1
+
+  # Emit the URL on stdout in a shape ActionLogPanel's regex captures.
+  # The button is a redundant re-spawn fallback — by the time the chat-side
+  # ActionLogPanel renders, the page is already on the Pi VNC chromium per
+  # the spawn below. Button click POSTs to /api/admin/device-browser/navigate
+  # to re-target the same URL on the VNC; same end-effect as this spawn.
+  printf 'OAUTH_URL: %s\n' "${AUTH_URL}"
+
+  # Mechanically open the URL on the Pi VNC chromium (Task 858). Chromium
+  # is already running on this brand's ${BRAND_VNC_DISPLAY} with CDP enabled
+  # (vnc.sh start_chrome at boot); invoking the resolved binary <url> against
+  # a running instance IPCs the URL into it as a new tab. Replaces
+  # cloudflared's own optimistic xdg-open, which does not reliably target
+  # the brand's VNC display in this environment.
+  #
+  # Task 982 — chromium is launched under a transient systemd-user unit so
+  # the full process tree (including any standalone chromium that lands
+  # when no existing instance is running for IPC) lives in its own cgroup.
+  # On cert.pem arrival the unit is stopped, SIGTERMing the whole cgroup
+  # atomically. Pre-Task-982 the spawn was `&` fire-and-forget with no
+  # tracked PID; the resulting orphan chromium on display :101 was the
+  # symptom in maxy-2 2026-05-12T10:06–10:08Z. `step=browser-close
+  # result=ok|orphan` records the teardown outcome at cert.pem mv site
+  # below.
+  #
+  # Binary path: SETUP_TUNNEL_CHROMIUM_BIN is read at startup from
+  # ${MAXY_PLATFORM_ROOT}/config/chromium-binary.path — `/usr/bin/chromium`
+  # on Pi Bookworm and `/usr/bin/google-chrome-stable` on Ubuntu Noble laptop
+  # where the system chromium is snap-confined (Task 929). Hardcoding
+  # `/usr/bin/chromium` here would re-introduce the AppArmor SingletonLock
+  # failure on the laptop.
+  CHROMIUM_UNIT="maxy-oauth-chromium-${BRAND}-$$.service"
+  CHROMIUM_LAUNCH_DISPLAY="${DISPLAY:-${BRAND_VNC_DISPLAY}}"
+  CHROMIUM_SPAWN_ERR="$(mktemp -t maxy-oauth-chromium-err.XXXXXX)"
+  if systemd-run --user \
+      --unit="${CHROMIUM_UNIT}" \
+      --description="Maxy OAuth chromium for ${BRAND}" \
+      --collect \
+      --setenv=DISPLAY="${CHROMIUM_LAUNCH_DISPLAY}" \
+      "${SETUP_TUNNEL_CHROMIUM_BIN}" "${AUTH_URL}" 2>"${CHROMIUM_SPAWN_ERR}"; then
+    rm -f "${CHROMIUM_SPAWN_ERR}"
+    phase_line setup-tunnel step=browser-spawn result=ok \
+      display="${CHROMIUM_LAUNCH_DISPLAY}" url_extracted=1 unit="${CHROMIUM_UNIT}"
+  else
+    SPAWN_RC=$?
+    SPAWN_STDERR="$(tr '\n' ' ' < "${CHROMIUM_SPAWN_ERR}" | head -c 300 || echo unavailable)"
+    rm -f "${CHROMIUM_SPAWN_ERR}"
+    # Loud-fail rather than fire-and-forget fallback: a systemd-run failure
+    # is the same class as the pre-Task-982 orphan (no teardown handle).
+    # Operator should see the bus-not-running / linger-not-enabled cause.
+    phase_line setup-tunnel step=browser-spawn result=error \
+      reason=systemd-run-failed exit="${SPAWN_RC}" stderr="${SPAWN_STDERR}" \
+      unit="${CHROMIUM_UNIT}"
+    echo "ERROR: systemd-run failed to spawn chromium under transient unit (exit=${SPAWN_RC})." >&2
+    echo "       systemd-run stderr: ${SPAWN_STDERR}" >&2
+    echo "       If stderr mentions 'Failed to connect to bus', enable user-scope" >&2
+    echo "       systemd via 'loginctl enable-linger \$(whoami)' and retry." >&2
+    exit 1
+  fi
+  phase_line setup-tunnel step=browser-drive mode=operator-click url="${AUTH_URL}"
+
+  # Wait for cert.pem to land — cloudflared writes to ~/.cloudflared/cert.pem
+  # regardless of --origincert, so watch the canonical location. The wait is
+  # human-paced: the operator must click the zone row + Authorize on the VNC.
+  # 180 s default budget; SETUP_TUNNEL_LOGIN_TIMEOUT overrides for testing.
+  # The 2-second heartbeat inside the loop is the observability contract —
+  # no form-spawned script is allowed a silent poll of more than ~2 s.
+  LOGIN_TIMEOUT="${SETUP_TUNNEL_LOGIN_TIMEOUT:-180}"
+  LOGIN_WAIT=0
+  while [ ! -f "${HOME}/.cloudflared/cert.pem" ]; do
+    if ! kill -0 "${CF_PIPELINE_PID}" 2>/dev/null; then
+      # Pipeline exited — one more cert.pem probe in case it landed right before exit.
+      if [ -f "${HOME}/.cloudflared/cert.pem" ]; then break; fi
+      phase_line setup-tunnel step=oauth-login result=error \
+        reason=cloudflared-exited-no-cert \
+        last_line="$(cat "${LAST_LINE_FILE}" 2>/dev/null || echo none)"
+      echo "ERROR: cloudflared exited before cert.pem landed." >&2
+      exit 1
+    fi
+    if [ "${LOGIN_WAIT}" -ge "${LOGIN_TIMEOUT}" ]; then
+      kill "${CF_PIPELINE_PID}" 2>/dev/null || true
+      phase_line setup-tunnel step=oauth-login result=error \
+        reason=timeout-waiting-cert waited="${LOGIN_WAIT}s" \
+        last_line="$(cat "${LAST_LINE_FILE}" 2>/dev/null || echo none)"
+      echo "ERROR: Timed out after ${LOGIN_WAIT}s waiting for cert.pem to land." >&2
+      exit 1
+    fi
+    # Heartbeat every 2 s after the click. t=0 is the browser-drive
+    # phase line above; the first heartbeat fires at t=2. Without this line
+    # the tailer sees silence for the full 1-20 s round-trip — the exact
+    # state Task 588 forbids.
+    if [ "${LOGIN_WAIT}" -gt 0 ] && [ $((LOGIN_WAIT % 2)) -eq 0 ]; then
+      phase_line setup-tunnel step=oauth-login result=awaiting-cert \
+        elapsed="${LOGIN_WAIT}s" timeout="${LOGIN_TIMEOUT}s"
+    fi
+    sleep 1
+    LOGIN_WAIT=$((LOGIN_WAIT + 1))
+  done
+
+  mv "${HOME}/.cloudflared/cert.pem" "${CFG_DIR}/cert.pem"
+  phase_line setup-tunnel step=oauth-login result=ok \
+    path="${CFG_DIR}/cert.pem" waited="${LOGIN_WAIT}s"
+
+  # Task 982 — SIGTERM the OAuth chromium cgroup now that cert.pem has
+  # landed. The transient unit was created above at step=browser-spawn; if
+  # chromium IPCs'd to a running brand-VNC instance and exited cleanly, the
+  # unit is already auto-collected and `systemctl stop` returns 0 (no-such-
+  # unit is a benign race, not an orphan). If chromium is still alive (no
+  # pre-existing brand-VNC instance to IPC into), SIGTERM tears the whole
+  # cgroup atomically. `result=ok` covers both clean paths; `result=orphan`
+  # fires only when the stop command itself fails (bus issue, race with
+  # auto-collect that returned non-zero) — operator-visible signal that an
+  # orphan chromium MAY still be alive on the VNC display.
+  CHROMIUM_STOP_ERR="$(mktemp -t maxy-oauth-chromium-stop-err.XXXXXX)"
+  if systemctl --user stop "${CHROMIUM_UNIT}" 2>"${CHROMIUM_STOP_ERR}"; then
+    rm -f "${CHROMIUM_STOP_ERR}"
+    phase_line setup-tunnel step=browser-close result=ok unit="${CHROMIUM_UNIT}"
+  else
+    STOP_RC=$?
+    STOP_STDERR="$(tr '\n' ' ' < "${CHROMIUM_STOP_ERR}" | head -c 300 || echo unavailable)"
+    rm -f "${CHROMIUM_STOP_ERR}"
+    # Distinguish benign "unit already auto-collected" from a true teardown
+    # failure via systemctl's exit-code taxonomy — never via stderr prose
+    # parsing, which breaks on non-English locales (no-stdout-parsing-for-
+    # control-flow doctrine). Exit code 5 is systemd's canonical "Unit not
+    # loaded" return; --collect auto-GCs a terminated unit between the
+    # chromium-side IPC-and-exit and our stop, producing exactly this code.
+    # Any other non-zero exit is a real teardown failure (bus down, permission,
+    # service still alive but stop hung).
+    if [ "${STOP_RC}" -eq 5 ]; then
+      phase_line setup-tunnel step=browser-close result=ok \
+        reason=unit-auto-collected unit="${CHROMIUM_UNIT}"
+    else
+      phase_line setup-tunnel step=browser-close result=orphan \
+        reason=stop-failed exit="${STOP_RC}" stderr="${STOP_STDERR}" \
+        unit="${CHROMIUM_UNIT}"
+      echo "WARNING: failed to stop transient chromium unit ${CHROMIUM_UNIT} (exit=${STOP_RC})." >&2
+      echo "         An orphan chromium may remain on display ${CHROMIUM_LAUNCH_DISPLAY}." >&2
+      echo "         systemctl stderr: ${STOP_STDERR}" >&2
+    fi
+  fi
+fi
+
+# --------------------------------------------------------------------------
+# Step 2+3: Resolve the tunnel identity from operator input (Task 886 §B).
+#
+# Pre-Task-886 the script derived TUNNEL_NAME locally as "${BRAND}-$(hostname
+# -s)" and reused-or-created. That breaks the same doctrine as pre-Task-589
+# zone selection: the local hostname has no authority over which tunnel the
+# operator's logged-in Cloudflare account holds. A renamed device produced a
+# new tunnel; existing CNAMEs continued to point at the old one; the chat
+# said "Done. tunnel=maxy-maxytest" while the operator's `maxytest` hostname
+# kept resolving via a stale orphan.
+#
+# New contract: the form (rendered via /api/admin/cloudflare/tunnels list) is
+# the source of truth. The endpoint passes exactly one of:
+#   TUNNEL_ID   — operator selected an existing tunnel from the list
+#   TUNNEL_NAME — operator typed a name to create a new tunnel
+# The endpoint validates the exactly-one constraint; the script enforces it
+# again here as defence in depth. Setting both, or neither, is a misuse.
+# --------------------------------------------------------------------------
+
+if [ -n "${TUNNEL_ID:-}" ] && [ -n "${TUNNEL_NAME:-}" ]; then
+  phase_line setup-tunnel step=tunnel-resolve result=error reason=both-set
+  echo "ERROR: TUNNEL_ID and TUNNEL_NAME are mutually exclusive — pass exactly one." >&2
+  exit 1
+fi
+if [ -z "${TUNNEL_ID:-}" ] && [ -z "${TUNNEL_NAME:-}" ]; then
+  phase_line setup-tunnel step=tunnel-resolve result=error reason=neither-set
+  echo "ERROR: TUNNEL_ID (selected) or TUNNEL_NAME (explicit-create) is required." >&2
+  echo "       The form derives one of these from operator input via" >&2
+  echo "       /api/admin/cloudflare/tunnels — re-run the form, do not" >&2
+  echo "       invoke this script directly without one of the env vars." >&2
+  exit 1
+fi
+
+if [ -n "${TUNNEL_ID:-}" ]; then
+  # Operator-selected branch. Resolve the name back from `tunnel list` for
+  # the log line + tunnel.state file. A missing row here means the operator
+  # selected a tunnel that has since been deleted from another surface
+  # (rare but possible) — fail loudly so the operator sees the cause
+  # rather than getting a silent fallback to "create new".
+  TUNNEL_NAME="$(cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel list --output json 2>/dev/null \
+    | jq -r --arg I "${TUNNEL_ID}" '.[]? | select(.id == $I) | .name' | head -1)"
+  if [ -z "${TUNNEL_NAME}" ] || [ "${TUNNEL_NAME}" = "null" ]; then
+    phase_line setup-tunnel step=tunnel-resolve result=error \
+      reason=selected-tunnel-not-found tunnel_id="${TUNNEL_ID}"
+    echo "ERROR: TUNNEL_ID ${TUNNEL_ID} is not on the logged-in Cloudflare account." >&2
+    echo "       It may have been deleted from the dashboard since the form loaded." >&2
+    echo "       Re-render the form to refresh the tunnel list." >&2
+    exit 1
+  fi
+  TUNNEL_SOURCE="operator-selected"
+else
+  # Operator-create branch. Refuse to silently reuse an existing tunnel of
+  # the same name — that recreates the pre-Task-886 silent-collision bug.
+  # The operator should have picked it from the list.
+  EXISTING_ID="$(cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel list --output json 2>/dev/null \
+    | jq -r --arg N "${TUNNEL_NAME}" '.[]? | select(.name == $N) | .id' | head -1)"
+  if [ -n "${EXISTING_ID}" ] && [ "${EXISTING_ID}" != "null" ]; then
+    phase_line setup-tunnel step=tunnel-resolve result=error \
+      reason=name-already-exists tunnel_name="${TUNNEL_NAME}" tunnel_id="${EXISTING_ID}"
+    echo "ERROR: a tunnel named ${TUNNEL_NAME} already exists (id=${EXISTING_ID})." >&2
+    echo "       Re-render the form and select it from the list, or pick a different name." >&2
+    exit 1
+  fi
+  cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel create "${TUNNEL_NAME}"
+  TUNNEL_ID="$(cloudflared --origincert "${CFG_DIR}/cert.pem" tunnel list --output json \
+    | jq -r --arg N "${TUNNEL_NAME}" '.[]? | select(.name == $N) | .id' | head -1)"
+  if [ -z "${TUNNEL_ID}" ] || [ "${TUNNEL_ID}" = "null" ]; then
+    phase_line setup-tunnel step=tunnel-resolve result=error \
+      reason=create-then-uuid-missing tunnel_name="${TUNNEL_NAME}"
+    echo "ERROR: created tunnel ${TUNNEL_NAME} but its UUID is missing from tunnel list." >&2
+    exit 1
+  fi
+  TUNNEL_SOURCE="operator-created"
+fi
+phase_line setup-tunnel step=tunnel-resolve source="${TUNNEL_SOURCE}" \
+  tunnel_id="${TUNNEL_ID}" tunnel_name="${TUNNEL_NAME}"
+echo "tunnel: ${TUNNEL_NAME} (${TUNNEL_ID}) [${TUNNEL_SOURCE}]"
+
+# --------------------------------------------------------------------------
+# Step 3b: Zone pre-flight. Before routing DNS, verify every non-apex
+# hostname's registrable parent (last two labels, e.g. rogerblack.maxy.bot
+# → maxy.bot) has NS records pointing at Cloudflare. If any hostname's
+# parent zone is not on Cloudflare, refuse the whole run before calling
+# `cloudflared tunnel route dns`.
+#
+# DESIGN NOTE — what this catches and what it does NOT catch (Task 559):
+#   CATCHES: parent zone does not exist, or its NS records do not point
+#     at Cloudflare's nameservers. Pre-529 the shell relied on a post-
+#     flight sed of cloudflared's stdout for this defence; Task 559
+#     deletes that parser because it rejects the idempotent no-op output
+#     shape (session 25674fe3) and replaces it with this inline NS probe.
+#     Same primitive the MCP path uses in
+#     cloudflared.ts::checkZoneParentOnCloudflare.
+#   DOES NOT CATCH: the zone is on Cloudflare but on a DIFFERENT account
+#     than the one cert.pem is bound to. A true account-zone-list check
+#     requires either a cloudflared CLI zone-list subcommand (does not
+#     exist as of 2026-04) or persisting the bound account's zones at
+#     tunnel-login time (deferred — separate task). The wrong-account
+#     case is detected post-hoc by tunnel-status's hostname probe, not
+#     here. This is an explicitly accepted gap per Task 559's scope.
+#
+# Probe uses 1.1.1.1 directly to bypass the device's local resolver
+# (matching Resolver.setServers in the MCP path) — avoids cache /
+# split-horizon issues on the Pi.
+# --------------------------------------------------------------------------
+
+is_apex() {
+  local h="$1"
+  # Apex heuristic: exactly one dot (e.g. maxy.chat). Breaks for
+  # multi-label public suffixes like .co.uk; refine if needed.
+  [ "$(echo -n "$h" | tr -cd '.' | wc -c)" = "1" ]
+}
+
+registrable_parent() {
+  local h="$1"
+  local labels n
+  IFS='.' read -ra labels <<< "${h}"
+  n=${#labels[@]}
+  if [ "${n}" -le 2 ]; then
+    printf '%s' "${h}"
+  else
+    printf '%s.%s' "${labels[$((n-2))]}" "${labels[$((n-1))]}"
+  fi
+}
+
+if ! command -v dig >/dev/null 2>&1; then
+  phase_line setup-tunnel step=zone-preflight result=error \
+    reason=dig-missing
+  echo "ERROR: dig is not in PATH — required for the zone pre-flight check." >&2
+  echo "       Re-run the Maxy installer to reprovision DNS tooling (bind9-dnsutils)." >&2
+  exit 1
+fi
+
+ZONES_SEEN=""
+MISSING_PARENT=""
+for H in "${HOSTNAMES[@]}"; do
+  if is_apex "$H"; then continue; fi
+  ZONE="$(registrable_parent "$H")"
+  NS_OUT="$(dig +short +time=3 +tries=1 NS "${ZONE}" @1.1.1.1 2>/dev/null || true)"
+  if printf '%s' "${NS_OUT}" | grep -qiE '\.ns\.cloudflare\.com\.?$'; then
+    case ",${ZONES_SEEN}," in
+      *",${ZONE},"*) ;;
+      *) ZONES_SEEN="${ZONES_SEEN:+${ZONES_SEEN},}${ZONE}" ;;
+    esac
+  else
+    MISSING_PARENT="${H}"
+    break
+  fi
+done
+
+if [ -n "${MISSING_PARENT}" ]; then
+  MISSING_ZONE="$(registrable_parent "${MISSING_PARENT}")"
+  phase_line setup-tunnel step=zone-preflight result=error \
+    missing_parent_for="${MISSING_PARENT}" \
+    zones_on_account="${ZONES_SEEN}"
+  echo "" >&2
+  echo "ERROR: cannot route ${MISSING_PARENT} — its parent zone ${MISSING_ZONE}" >&2
+  echo "       is not on Cloudflare (NS records do not point at *.ns.cloudflare.com)." >&2
+  echo "       Zones confirmed on Cloudflare so far: ${ZONES_SEEN:-none}" >&2
+  echo "" >&2
+  echo "       Fix: sign into the Cloudflare account that owns ${MISSING_ZONE}" >&2
+  echo "         1. ~/reset-tunnel.sh        # clear cert.pem and tunnel state" >&2
+  echo "         2. ~/setup-tunnel.sh ...    # re-run while signed into the correct account" >&2
+  exit 1
+fi
+
+phase_line setup-tunnel step=zone-preflight result=ok \
+  zones_on_account="${ZONES_SEEN}"
+
+# --------------------------------------------------------------------------
+# Step 4: Route DNS. Apex hostnames (exactly two DNS labels) cannot be
+# routed via `cloudflared tunnel route dns` — it misroutes them into
+# another zone on the account. Skip CLI routing for apex; collect for the
+# ACTION REQUIRED summary at the end.
+#
+# Control flow (Task 559): cloudflared's exit code is the sole decision
+# signal. No stdout parsing. `cloudflared tunnel route dns --overwrite-dns`
+# exits 0 on every legitimate outcome (create, overwrite, already-correct
+# no-op) and non-zero on every legitimate failure. The pre-flight above
+# already refused if the parent zone is not on Cloudflare; the post-flight
+# parser the shell historically carried (deleted in 559) rejected the
+# idempotent no-op output shape `INF <h> is already configured to
+# route...` and caused session 25674fe3 to die after cloudflared exited 0.
+# --------------------------------------------------------------------------
+
+APEX_HOSTNAMES=()
+for H in "${HOSTNAMES[@]}"; do
+  if is_apex "$H"; then
+    APEX_HOSTNAMES+=("$H")
+    phase_line setup-tunnel step=route-dns hostname="${H}" result=apex-skip
+    echo "apex ${H} — skipping CLI DNS routing (manual dashboard step required)"
+    continue
+  fi
+
+  phase_line setup-tunnel step=route-dns hostname="${H}" tunnel_id="${TUNNEL_ID}"
+  ROUTE_LOG="$(mktemp -t maxy-route-dns.XXXXXX)"
+  # tee_subprocess_capture streams cloudflared's combined stdout+stderr
+  # into STREAM_LOG_PATH line-by-line with the [script:setup-tunnel:cloudflared]
+  # tag (live-tailable — Task 605 chat-surface namespace) AND passes the same output through this shell's
+  # stdout so the `> "${ROUTE_LOG}"` redirection can capture it for the
+  # failure-path phase_line. Exit code is cloudflared's PIPESTATUS[0].
+  if tee_subprocess_capture setup-tunnel:cloudflared -- \
+      cloudflared --origincert "${CFG_DIR}/cert.pem" \
+      tunnel route dns --overwrite-dns "${TUNNEL_ID}" "${H}" \
+      > "${ROUTE_LOG}"; then
+    phase_line setup-tunnel step=route-dns hostname="${H}" result=ok
+  else
+    ROUTE_RC=$?
+    STDERR_BOUNDED="$(tr '\n' ' ' < "${ROUTE_LOG}" | head -c 400)"
+    phase_line setup-tunnel step=route-dns hostname="${H}" result=error \
+      exit="${ROUTE_RC}" stderr="${STDERR_BOUNDED}"
+    echo "ERROR: cloudflared tunnel route dns failed for ${H} (exit=${ROUTE_RC})" >&2
+    echo "       stderr: ${STDERR_BOUNDED}" >&2
+    rm -f "${ROUTE_LOG}"
+    exit 1
+  fi
+  rm -f "${ROUTE_LOG}"
+done
+
+# --------------------------------------------------------------------------
+# Step 5: Write config.yml. Every hostname (apex + subdomain) gets an
+# ingress rule — apex still needs the rule for the connector to serve
+# traffic once DNS is manually pointed.
+# --------------------------------------------------------------------------
+
+{
+  echo "tunnel: ${TUNNEL_ID}"
+  echo "credentials-file: ${CFG_DIR}/${TUNNEL_ID}.json"
+  echo "ingress:"
+  for H in "${HOSTNAMES[@]}"; do
+    echo "  - hostname: ${H}"
+    echo "    service: http://localhost:${PORT}"
+  done
+  echo "  - service: http_status:404"
+} > "${CFG_DIR}/config.yml"
+echo "wrote ${CFG_DIR}/config.yml"
+
+# --------------------------------------------------------------------------
+# Step 5b: Write tunnel.state. Required by resume-tunnel.sh — without it
+# the brand.service's ExecStartPre exits silently without spawning a
+# connector.
+# --------------------------------------------------------------------------
+
+cat > "${CFG_DIR}/tunnel.state" <<EOF
+{
+  "tunnelId": "${TUNNEL_ID}",
+  "tunnelName": "${TUNNEL_NAME}",
+  "domain": "${HOSTNAMES[0]}",
+  "configPath": "${CFG_DIR}/config.yml",
+  "credentialsPath": "${CFG_DIR}/${TUNNEL_ID}.json"
+}
+EOF
+echo "wrote ${CFG_DIR}/tunnel.state"
+
+# --------------------------------------------------------------------------
+# Step 6: Persist onboarding step-7 completion BEFORE arming the restart.
+#
+# Task 562: the service restart below SIGTERMs the admin-agent subprocess
+# before it can call `onboarding-complete-step 7`. Persisting the completion
+# here — inside the shell script — removes the LLM from the decision path
+# and closes the race. Next session's `loadOnboardingStep` / `getOnboardingState`
+# reads the flag file and advances the graph via the same idempotent
+# CASE-WHEN-NULL cypher as `completeOnboardingStep`.
+#
+# ACCOUNT_DIR is exported by claude-agent.ts::buildSpawnEnv and inherited
+# by every Bash-tool subprocess. If it is unset, this script was invoked
+# outside an agent session (operator-initiated reconfig via SSH) — there
+# is no onboarding to persist, so skip loudly without error. No $PWD
+# fallback: the Bash-tool cwd can drift across invocations, and writing
+# the marker into a stray directory would silently detach it from any
+# reader.
+#
+# The flag payload is JSON so the next session's consumer can use the
+# real completion timestamp (not its own Date.now()) and cross-reference
+# by tunnelId during forensic investigations.
+# --------------------------------------------------------------------------
+
+if [ -n "${ACCOUNT_DIR:-}" ]; then
+  ONBOARDING_DIR="${ACCOUNT_DIR}/onboarding"
+  ONBOARDING_FLAG="${ONBOARDING_DIR}/step7-complete"
+  PERSIST_NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  if ! mkdir -p "${ONBOARDING_DIR}" 2>/dev/null; then
+    phase_line setup-tunnel step=onboarding-persist result=error \
+      reason=fs-flag-dir-failed path="${ONBOARDING_DIR}"
+    echo "WARNING: could not create ${ONBOARDING_DIR} — step-7 completion not persisted." >&2
+    echo "         The next admin session will re-ask the Cloudflare question." >&2
+  elif ! printf '{"completedAt":"%s","tunnelId":"%s"}\n' "${PERSIST_NOW}" "${TUNNEL_ID}" \
+      > "${ONBOARDING_FLAG}" 2>/dev/null; then
+    phase_line setup-tunnel step=onboarding-persist result=error \
+      reason=fs-flag-write-failed path="${ONBOARDING_FLAG}"
+    echo "WARNING: could not write ${ONBOARDING_FLAG} — step-7 completion not persisted." >&2
+    echo "         The next admin session will re-ask the Cloudflare question." >&2
+  else
+    phase_line setup-tunnel step=onboarding-persist result=ok \
+      path="${ONBOARDING_FLAG}" completedAt="${PERSIST_NOW}"
+  fi
+else
+  phase_line setup-tunnel step=onboarding-persist result=skipped \
+    reason=no-account-dir
+fi
+
+# --------------------------------------------------------------------------
+# Restart the brand's user-space service so resume-tunnel.sh (its
+# ExecStartPre) picks up the new tunnel.state + config.yml and spawns the
+# connector.
+#
+# CRITICAL: this script runs inside ${BRAND}.service's cgroup whenever the
+# admin agent invokes it via the Bash tool. `systemctl --user restart
+# ${BRAND}.service` from inside that cgroup SIGTERMs the whole cgroup —
+# the node server, the claude subprocess, the Bash child, and this script
+# itself (Task 558). Dispatching the restart to a transient systemd-run
+# unit is the ONLY primitive that creates a new cgroup outside the service
+# — setsid/nohup/disown/& all inherit cgroup membership, and
+# `systemd-run --scope` runs in the caller's scope.
+#
+# The transient timer fires $RESTART_DELAY seconds after dispatch; the
+# script exits 0 cleanly in microseconds, then the timer restarts the
+# service from its own cgroup — semantically identical to an operator
+# SSH-invoked `systemctl restart`. Post-restart verification (connector
+# up + hostname probe) is out of scope here — the client reconnects and
+# the next admin turn can verify via MCP tools.
+# --------------------------------------------------------------------------
+
+if ! systemctl --user list-unit-files "${BRAND}.service" --no-pager --no-legend | grep -q "${BRAND}.service"; then
+  echo "ERROR: user-space service ${BRAND}.service not installed — cannot bring the tunnel up" >&2
+  echo "       Install the platform first (create-maxy) before running this script." >&2
+  exit 1
+fi
+
+if ! command -v systemd-run >/dev/null 2>&1; then
+  phase_line setup-tunnel step=service-restart-dispatched result=error \
+    reason=systemd-run-missing
+  echo "ERROR: systemd-run is not in PATH." >&2
+  echo "       The script dispatches the ${BRAND}.service restart to a transient" >&2
+  echo "       systemd user unit so it does not kill its own cgroup." >&2
+  echo "       Install systemd userspace (standard on supported Maxy Pi images)." >&2
+  exit 1
+fi
+
+RESTART_DELAY=3
+TRANSIENT_UNIT="maxy-tunnel-restart-$$-$(date +%s)"
+phase_line setup-tunnel step=service-restart-dispatched \
+  unit="${TRANSIENT_UNIT}" delay="${RESTART_DELAY}s" \
+  cmd="systemctl --user restart ${BRAND}.service"
+
+# Dispatch via systemd-run --user --on-active — creates a transient unit
+# with its own cgroup that fires the restart after RESTART_DELAY seconds.
+# --collect auto-GCs the unit after it terminates. The script exits before
+# the timer fires; no race because the exit is microseconds and the timer
+# is seconds. Capture stderr so the operator sees the actual systemd-run
+# failure reason (e.g. "Failed to connect to bus" when linger is disabled).
+SYSTEMD_RUN_ERR="$(mktemp -t maxy-systemd-run-err.XXXXXX)"
+if systemd-run --user --unit="${TRANSIENT_UNIT}.service" \
+    --description="Detached restart of ${BRAND}.service" \
+    --on-active="${RESTART_DELAY}s" \
+    --collect \
+    /bin/systemctl --user restart "${BRAND}.service" 2>"${SYSTEMD_RUN_ERR}"; then
+  RESTART_RC=0
+else
+  RESTART_RC=$?
+fi
+
+if [ "${RESTART_RC}" -ne 0 ]; then
+  STDERR_TEXT="$(cat "${SYSTEMD_RUN_ERR}" 2>/dev/null | tr '\n' ' ' | head -c 500 || echo 'unavailable')"
+  rm -f "${SYSTEMD_RUN_ERR}"
+  phase_line setup-tunnel step=service-restart-dispatched result=error \
+    reason=systemd-run-failed exit="${RESTART_RC}" unit="${TRANSIENT_UNIT}" \
+    stderr="${STDERR_TEXT}"
+  echo "ERROR: systemd-run failed to dispatch the transient restart (exit=${RESTART_RC})." >&2
+  echo "       systemd-run stderr: ${STDERR_TEXT}" >&2
+  echo "       If stderr mentions 'Failed to connect to bus', the user-scope systemd" >&2
+  echo "       instance isn't running. Fix: 'loginctl enable-linger \$(whoami)' and retry." >&2
+  echo "       The service was NOT restarted. Re-run the script or restart manually:" >&2
+  echo "         systemctl --user restart ${BRAND}.service" >&2
+  exit 1
+fi
+rm -f "${SYSTEMD_RUN_ERR}"
+
+phase_line setup-tunnel step=service-restart-armed exit=0 unit="${TRANSIENT_UNIT}"
+echo "${BRAND}.service restart armed via ${TRANSIENT_UNIT} (fires in ${RESTART_DELAY}s)."
+
+# --------------------------------------------------------------------------
+# Apex ACTION REQUIRED summary
+# --------------------------------------------------------------------------
+
+if [ "${#APEX_HOSTNAMES[@]}" -gt 0 ]; then
+  echo ""
+  echo "============================================================"
+  echo "ACTION REQUIRED — manual dashboard step(s) for apex hostnames"
+  echo "============================================================"
+  for H in "${APEX_HOSTNAMES[@]}"; do
+    echo "  ${H}"
+    echo "    Cloudflare dashboard → ${H} zone → DNS → Records"
+    echo "    Edit (or Add) CNAME record:"
+    echo "      Name:    @  (zone apex)"
+    echo "      Content: ${TUNNEL_ID}.cfargotunnel.com"
+    echo "      Proxy:   Proxied (orange cloud)"
+    echo ""
+  done
+  echo "Until each apex record is set, those hostnames will return 1033."
+  echo "============================================================"
+fi
+
+phase_line setup-tunnel step=done tunnel="${TUNNEL_NAME}" id="${TUNNEL_ID}"
+echo ""
+echo "Done. tunnel=${TUNNEL_NAME} id=${TUNNEL_ID}"
+echo "Service will restart in ~${RESTART_DELAY}s to load the new config."
+echo "Verify hostnames with: curl -I https://${HOSTNAMES[0]}"