feat(cloudflare): 完成隧道接入、运维与 P0 体验优化

internal/cloudflared/config.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+
+	"github.com/fonu/fonu/internal/proxy"
 )
 
 type tokenPayload struct {
@@ -86,6 +88,9 @@ func BuildConfig(tunnelID, credsPath string, network NetworkSettings, ingress []
 	for _, rule := range ingress {
 		if rule.Hostname != "" {
 			fmt.Fprintf(&b, "  - hostname: %s\n", rule.Hostname)
+			if path := strings.TrimSpace(rule.Path); path != "" && path != "*" {
+				fmt.Fprintf(&b, "    path: %s\n", path)
+			}
 			fmt.Fprintf(&b, "    service: %s\n", rule.Service)
 			continue
 		}
@@ -144,6 +149,33 @@ func BuildIngress(hostnames []string, service string) []IngressRule {
 	return append(out, IngressRule{Service: "http_status:404"})
 }
 
+// BuildIngressForRules 从反向代理规则派生 ingress，每条域名使用自己的回源地址。
+func BuildIngressForRules(rules []proxy.Rule) []IngressRule {
+	serviceByHost := map[string]string{}
+	for _, rule := range rules {
+		if !rule.CloudflareEnabled() {
+			continue
+		}
+		service := strings.TrimSpace(rule.Upstream)
+		if service == "" {
+			continue
+		}
+		for _, host := range rule.Hostnames() {
+			serviceByHost[host] = service
+		}
+	}
+	hosts := make([]string, 0, len(serviceByHost))
+	for host := range serviceByHost {
+		hosts = append(hosts, host)
+	}
+	sort.Strings(hosts)
+	out := make([]IngressRule, 0, len(hosts)+1)
+	for _, host := range hosts {
+		out = append(out, IngressRule{Hostname: host, Service: serviceByHost[host]})
+	}
+	return append(out, IngressRule{Service: "http_status:404"})
+}
+
 // NormalizeService 生成回源 service；localhost 归一化为 127.0.0.1。
 func NormalizeService(protocol, host string, port int) string {
 	host = strings.TrimSpace(host)