From a55b53f1bdd3fb4cbd6fed63983beaa8236e0d4e Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Mon, 27 Apr 2026 16:51:58 -0500
Subject: [PATCH] fix: add registry.neuralplatform.ai to Cloudflare tunnel
 config

Was missing from tunnel ingress rules, causing 404 on all registry
requests through Cloudflare. Disabled chunked encoding for Docker
push compatibility.
---
 servers/legion/main.tf | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index db46d72..cad20a3 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -247,6 +247,16 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
+    # registry.neuralplatform.ai — Docker container registry (no Cloudflare buffering)
+    ingress_rule {
+      hostname = "registry.neuralplatform.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify           = true
+        disable_chunked_encoding = true
+      }
+    }
+
     # vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane)
     # Route directly to Headscale — bypasses Traefik which strips the Upgrade: ts2021 header
     # Cloudflare handles TLS termination; internal connection is plain HTTP