#!/usr/bin/env sh
set -eu

config=deploy/tunnel/cloudflared-config.yml
grep -q '^tunnel: [0-9a-f-]*$' "$config"
grep -q '^  - hostname: auth.example.test$' "$config"
grep -q '^    service: http://reverse-proxy:8080$' "$config"
grep -q '^  - service: http_status:404$' "$config"

docker run --rm \
  -v "$PWD/$config:/etc/cloudflared/config.yml:ro" \
  cloudflare/cloudflared:2025.6.1 \
  tunnel --config /etc/cloudflared/config.yml ingress validate

echo "Cloudflare named-tunnel ingress configuration verified"