скрипт получения cert.pem для cloudflared туннеля

#!/bin/bash

## example parameters, adjust as needed
ORIGIN_CA_KEY="v1.0-foobar"
CF_API_KEY="asdfasdfasdfasdf"
CF_EMAIL="user@example.com"
TUNNEL_ZONE_ID="6795546b5945173001744653a958d6cf"
TUNNEL_HOSTNAMES='["mytunnel.example.com"]'
 
## now for the actual script:
set -e
 
curl -s https://api.cloudflare.com/client/v4/user/service_keys/origintunnel \
  -H "x-auth-key: $CF_API_KEY" \
  -H "x-auth-email: $CF_EMAIL" \
  | jq -r .result.service_key \
  > tunnel_service_key.txt
 
# generate private key
openssl ecparam -name prime256v1 -out tunnel_private_key_params.txt
openssl req -batch -new -newkey ec:tunnel_private_key_params.txt -nodes -out csr.txt -keyout tunnel_private_key.txt -subj "/C=US/CN=CloudFlare"
 
# make cert.pem, containing
# 1. Private key (in PKCS #8 format)
openssl pkcs8 -topk8 -in tunnel_private_key.txt -nocrypt -out cert.pem
 
# 2. public key from originCA
curl -s -XPOST https://api.cloudflare.com/client/v4/certificates \
  -H "Content-Type: application/json" \
  -H "X-Auth-User-Service-Key: $ORIGIN_CA_KEY" \
  -d "$(jq -n --arg csr "$(cat csr.txt)" --argjson hostnames "$TUNNEL_HOSTNAMES" '{hostnames:$hostnames,requested_validity:5475,request_type:"origin-ecc",csr:$csr}')" \
  | jq -r .result.certificate \
  >> cert.pem
 
# 3. Argo Tunnel token
echo "-----BEGIN ARGO TUNNEL TOKEN-----" >> cert.pem
echo -n "$(echo $TUNNEL_ZONE_ID; cat tunnel_service_key.txt)" | base64 | fold -w 64 >> cert.pem
echo "-----END ARGO TUNNEL TOKEN-----" >> cert.pem

$ cloudflared tunnel login

$ cloudflared tunnel create tunnel-1
failed to create tunnel: couldn't create client to talk to Cloudflare Tunnel backend: Origin certificate needs to be refreshed before creating new tunnels.\nDelete /home/uzer/.cloudflared/cert.pem and run "cloudflared login" to obtain a new cert.