Cloudflare tunnel route inventory

Cloudflare Tunnel published application routes map a hostname/path to an origin service, commonly a local service such as http://localhost:<port> or a private Tailnet hostname. Cloudflare documents this as routing DNS/public hostnames to a tunnel-backed origin service.

Hostname alias note (2026-08-24): rows below use two Tailnet names for the same Oracle host — bluefly-platform.tailcf98b3.ts.net (current) and oracle-platform.tailcf98b3.ts.net (stale alias, superseded on-host 2026-07-18). Entries are recorded as configured in Cloudflare, not normalized. Use bluefly-platform for any new route; treat an oracle-platform origin as a route still pending rename in Cloudflare, not a second host.

Immediate phone-workstack target¶

Purpose	Tunnel	Hostname	Current origin service	Action
Open WebUI / phone chat	BlueflyAgents.com	`chat.blueflyagents.com`	`http://localhost:3080`	Use this. Bind Open WebUI to `127.0.0.1:3080:8080`. Do not create a new Cloudflare route for Wave 1.
OpenCode remote access	BlueflyAgents.com	`opencode.blueflyagents.com`	`http://bluefly-platform.tailcf98b3.ts.net:4096`	Existing Oracle/Tailscale route. Preserve.
CoPaw OpenClaw-style route	CoPaw.us	`claw.copaw.us`	`http://bluefly-platform.tailcf98b3.ts.net:18789`	Existing Tailnet-origin route. Preserve.

AgentBlu.ai¶

#	Hostname	Path	Origin service
1	`agentblu.ai`	`*`	`http://localhost:3055`
2	`social.agentblu.ai`	`*`	`http://localhost:3028`
3	`app.agentblu.ai`	`*`	`http://localhost:3055`
4	`compliance.agentblu.ai`	`*`	`http://localhost:3010`

BlueflyAgents.com¶

#	Hostname	Path	Origin service
1	`auth.blueflyagents.com`	`*`	`http://localhost:8280`
2	`mesh.blueflyagents.com`	`*`	`http://localhost:3005`
3	`kagent.blueflyagents.com`	`*`	`http://localhost:3009`
4	`kagent-ui.blueflyagents.com`	`*`	`http://localhost:30080`
5	`mcpdash.blueflyagents.com`	`*`	`http://localhost:3003`
6	`router.blueflyagents.com`	`*`	`http://localhost:4000`
7	`agents.blueflyagents.com`	`*`	`http://localhost:3001`
8	`bk.blueflyagents.com`	`*`	`http://localhost:3097`
9	`ntfy.blueflyagents.com`	`*`	`http://localhost:8095`
10	`tracer.blueflyagents.com`	`*`	`http://localhost:3006`
11	`mcp.blueflyagents.com`	`*`	`http://localhost:4005`
12	`brain.blueflyagents.com`	`*`	`http://localhost:6333`
13	`compliance.blueflyagents.com`	`*`	`http://localhost:3010`
14	`workflow.blueflyagents.com`	`*`	`http://localhost:3015`
15	`devops.blueflyagents.com`	`*`	`http://localhost:3011`
16	`a2a-collector.blueflyagents.com`	`*`	`http://localhost:9004`
17	`a2a-stream.blueflyagents.com`	`*`	`http://localhost:9005`
18	`adash.blueflyagents.com`	`*`	`http://localhost:3013`
19	`gkg.blueflyagents.com`	`*`	`http://localhost:27495`
20	`ecma-agent.blueflyagents.com`	`*`	`http://localhost:3016`
21	`content-guardian.blueflyagents.com`	`*`	`http://localhost:4010`
22	`intel.blueflyagents.com`	`*`	`http://localhost:9006`
23	`langflow.blueflyagents.com`	`*`	`http://localhost:7860`
24	`grafana.blueflyagents.com`	`*`	`http://localhost:30300`
25	`n8n.blueflyagents.com`	`*`	`http://localhost:5678`
26	`infra.blueflyagents.com`	`*`	`http://localhost:3030`
27	`chat.blueflyagents.com`	`*`	`http://localhost:3080`
28	`orchestrator.blueflyagents.com`	`*`	`http://localhost:3014`
29	`api.blueflyagents.com`	`*`	`http://localhost:3085`
30	`skills.blueflyagents.com`	`*`	`http://localhost:4005`
31	`plugins.blueflyagents.com`	`*`	`http://localhost:3090`
32	`toolbox.blueflyagents.com`	`*`	`http://localhost:3096`
33	`marketplace.blueflyagents.com`	`*`	`http://localhost:3095`
34	`mcp-gateway.blueflyagents.com`	`*`	`http://localhost:8811`
35	`llm.blueflyagents.com`	`*`	`http://localhost:8000`
36	`blueflyagents.com`	`*`	`http://localhost:8090`
37	`opencode.blueflyagents.com`	`*`	`http://bluefly-platform.tailcf98b3.ts.net:4096`
Catch-all	`*`	`*`	`http_status:404`

CoPaw.us¶

#	Hostname	Path	Origin service
1	`copaw.us`	`*`	`http://localhost:3019`
2	`api.copaw.us`	`*`	`http://localhost:3050`
3	`auth.copaw.us`	`*`	`http://localhost:8280`
4	`compliance.copaw.us`	`*`	`http://localhost:3010`
5	`claw.copaw.us`	`*`	`http://bluefly-platform.tailcf98b3.ts.net:18789`
Catch-all	`*`	`*`	`http_status:404`

ContextControl.ai¶

#	Hostname	Path	Origin service
1	`compliance.contextcontrol.ai`	`*`	`http://localhost:3010`
2	`contextcontrol.ai`	`*`	`http://localhost:3000`
3	`source.contextcontrol.ai`	`*`	`http://localhost:9999`
Catch-all	`*`	`*`	`http_status:404`

ContractPlane.ai¶

#	Hostname	Path	Origin service
1	`api.contractplane.ai`	`*`	`http://localhost:3180`
2	`chat.contractplane.ai`	`*`	`http://localhost:3180`
3	`auth.contractplane.ai`	`*`	`http://localhost:8280`
4	`contractplane.ai`	`*`	`http://localhost:3180`
5	`www.contractplane.ai`	`*`	`http://localhost:3180`
6	`app.contractplane.ai`	`*`	`http://localhost:3180`
7	`docs.contractplane.ai`	`*`	`http://localhost:3180`
8	`compliance.contractplane.ai`	`*`	`http://localhost:3010`
9	`docs.contractplane.ai`	`*`	`http://localhost:3180`
10	`evidence.contractplane.ai`	`*`	`http://localhost:3010`
11	`registry.contractplane.ai`	`*`	`http://localhost:3010`
Catch-all	`*`	`*`	`http_status:404`

Note: docs.contractplane.ai appears twice with the same origin. That is a duplicate route to reconcile later.

Drupl.ai¶

#	Hostname	Path	Origin service
1	`drupl.ai`	`*`	`http://localhost:8090`
2	`bf.drupl.ai`	`*`	`http://localhost:4000`
3	`ContextControl.ai`	`*`	`http://localhost:8084`
4	`dragonfly.drupl.ai`	`*`	`http://localhost:3020`
5	`marketplace.drupl.ai`	`*`	`http://localhost:3090`
6	`m.drupl.ai`	`*`	`http://localhost:3090`
7	`app.drupl.ai`	`*`	`http://localhost:3093`
8	`auth.drupl.ai`	`*`	`http://localhost:8280`
9	`compliance.drupl.ai`	`*`	`http://localhost:3010`
10	`chat.drupl.ai`	`*`	`http://localhost:3080`
11	`marketplace-app.drupl.ai`	`*`	`http://localhost:8082`
12	`dev.drupl.ai`	`*`	`http://blueflynas.tailcf98b3.ts.net:8081`
13	`dev-app.drupl.ai`	`*`	`http://blueflynas.tailcf98b3.ts.net:8081`
14	`dev-dragonfly.drupl.ai`	`*`	`http://oracle-platform.tailcf98b3.ts.net:8484`
15	`dev-dragonfly-api.drupl.ai`	`*`	`http://oracle-platform.tailcf98b3.ts.net:3020`
16	`dev-marketplace-app.drupl.ai`	`*`	`http://blueflynas.tailcf98b3.ts.net:8082`
Catch-all	`*`	`*`	`http_status:404`

Defect (rows 14–15): oracle-platform.tailcf98b3.ts.net is a stale Tailscale name. The Oracle host's canonical name is bluefly-platform.tailcf98b3.ts.net (verified on-host 2026-07-18). These two ingress rules therefore resolve to nothing and the dev-dragonfly* hostnames are dead until the tunnel config is updated. Rows are recorded as observed — do not rewrite them here; fix the Cloudflare ingress, then re-inventory.

NAS¶

#	Hostname	Path	Origin service	Origin config
1	`nas.blueflyagents.com`	`*`	`https://localhost:5001`	`noTLSVerify`
2	`storage.blueflyagents.com`	`*`	`http://localhost:9000`	—
3	`s3console.blueflyagents.com`	`*`	`http://localhost:9001`	—
4	`code.blueflyagents.com`	`*`	`http://localhost:8080`	—
5	`dockge.blueflyagents.com`	`*`	`http://localhost:9010`	—
6	`npm.blueflyagents.com`	`*`	`http://localhost:4873`	—
7	`obsidian.blueflyagents.com`	`*`	`http://localhost:5984`	—
8	`zotero.blueflyagents.com`	`*`	`https://localhost:5006`	`noTLSVerify`
9	`flowise.blueflyagents.com`	`*`	`http://localhost:3100`	—
10	`langfuse.blueflyagents.com`	`*`	`http://localhost:3150`	—
11	`litellm.blueflyagents.com`	`*`	`http://localhost:4050`	—
12	`workspaces.blueflyagents.com`	`*`	`http://localhost:30443`	—
13	`*.workspaces.blueflyagents.com`	`*`	`http://localhost:30443`	—
14	`happy.blueflyagents.com`	`*`	`http://blueflynas.tailcf98b3.ts.net:3045`	—
Catch-all	`*`	`*`	`http_status:404`	—

OpenStandardAgents.org¶

#	Hostname	Path	Origin service
1	`studio.openstandardagents.org`	`*`	`http://localhost:7001`
2	`compliance.openstandardagents.org`	`*`	`http://localhost:3010`
Catch-all	`*`	`*`	`http_status:404`

duadp.org¶

#	Hostname	Path	Origin service
1	`telemetry.duadp.org`	`*`	`http://localhost:3035`
2	`discover.duadp.org`	`*`	`http://localhost:4201`
3	`register.duadp.org`	`*`	`http://localhost:4202`
4	`compliance.duadp.org`	`*`	`http://localhost:3010`
Catch-all	`*`	`*`	`http_status:404`

Port index¶

Port / target	Hostnames using it
`localhost:3000`	`contextcontrol.ai`
`localhost:3001`	`agents.blueflyagents.com`
`localhost:3003`	`mcpdash.blueflyagents.com`
`localhost:3005`	`mesh.blueflyagents.com`
`localhost:3006`	`tracer.blueflyagents.com`
`localhost:3009`	`kagent.blueflyagents.com`
`localhost:3010`	`compliance.agentblu.ai`, `compliance.blueflyagents.com`, `compliance.copaw.us`, `compliance.contextcontrol.ai`, `compliance.contractplane.ai`, `evidence.contractplane.ai`, `registry.contractplane.ai`, `compliance.drupl.ai`, `compliance.openstandardagents.org`, `compliance.duadp.org`
`localhost:3011`	`devops.blueflyagents.com`
`localhost:3013`	`adash.blueflyagents.com`
`localhost:3014`	`orchestrator.blueflyagents.com`
`localhost:3015`	`workflow.blueflyagents.com`
`localhost:3016`	`ecma-agent.blueflyagents.com`
`localhost:3019`	`copaw.us`
`localhost:3020`	`dragonfly.drupl.ai`
`localhost:3028`	`social.agentblu.ai`
`localhost:3030`	`infra.blueflyagents.com`
`localhost:3035`	`telemetry.duadp.org`
`localhost:3050`	`api.copaw.us`
`localhost:3055`	`agentblu.ai`, `app.agentblu.ai`
`localhost:3080`	`chat.blueflyagents.com`, `chat.drupl.ai`
`localhost:3085`	`api.blueflyagents.com`
`localhost:3090`	`plugins.blueflyagents.com`, `marketplace.drupl.ai`, `m.drupl.ai`
`localhost:3093`	`app.drupl.ai`
`localhost:3095`	`marketplace.blueflyagents.com`
`localhost:3096`	`toolbox.blueflyagents.com`
`localhost:3097`	`bk.blueflyagents.com`
`localhost:3100`	`flowise.blueflyagents.com`
`localhost:3150`	`langfuse.blueflyagents.com`
`localhost:3180`	`api.contractplane.ai`, `chat.contractplane.ai`, `contractplane.ai`, `www.contractplane.ai`, `app.contractplane.ai`, `docs.contractplane.ai`
`localhost:4000`	`router.blueflyagents.com`, `bf.drupl.ai`
`localhost:4005`	`mcp.blueflyagents.com`, `skills.blueflyagents.com`
`localhost:4010`	`content-guardian.blueflyagents.com`
`localhost:4050`	`litellm.blueflyagents.com`
`localhost:4201`	`discover.duadp.org`
`localhost:4202`	`register.duadp.org`
`localhost:5678`	`n8n.blueflyagents.com`
`localhost:5984`	`obsidian.blueflyagents.com`
`localhost:6333`	`brain.blueflyagents.com`
`localhost:7001`	`studio.openstandardagents.org`
`localhost:7860`	`langflow.blueflyagents.com`
`localhost:8000`	`llm.blueflyagents.com`
`localhost:8080`	`code.blueflyagents.com`
`localhost:8082`	`marketplace-app.drupl.ai`
`localhost:8084`	`ContextControl.ai`
`localhost:8090`	`blueflyagents.com`, `drupl.ai`
`localhost:8095`	`ntfy.blueflyagents.com`
`localhost:8280`	`auth.blueflyagents.com`, `auth.copaw.us`, `auth.contractplane.ai`, `auth.drupl.ai`
`localhost:8811`	`mcp-gateway.blueflyagents.com`
`localhost:9000`	`storage.blueflyagents.com`
`localhost:9001`	`s3console.blueflyagents.com`
`localhost:9004`	`a2a-collector.blueflyagents.com`
`localhost:9005`	`a2a-stream.blueflyagents.com`
`localhost:9006`	`intel.blueflyagents.com`
`localhost:27495`	`gkg.blueflyagents.com`
`localhost:30080`	`kagent-ui.blueflyagents.com`
`localhost:30300`	`grafana.blueflyagents.com`
`localhost:30443`	`workspaces.blueflyagents.com`, `*.workspaces.blueflyagents.com`
`bluefly-platform.tailcf98b3.ts.net:4096`	`opencode.blueflyagents.com`
`bluefly-platform.tailcf98b3.ts.net:18789`	`claw.copaw.us`
`blueflynas.tailcf98b3.ts.net:8081`	`dev.drupl.ai`, `dev-app.drupl.ai`
`blueflynas.tailcf98b3.ts.net:8082`	`dev-marketplace-app.drupl.ai`
`blueflynas.tailcf98b3.ts.net:3045`	`happy.blueflyagents.com`
`oracle-platform.tailcf98b3.ts.net:8484` (stale name — see defect note above)	`dev-dragonfly.drupl.ai`
`oracle-platform.tailcf98b3.ts.net:3020` (stale name — see defect note above)	`dev-dragonfly-api.drupl.ai`

Operational notes¶

Finding	Impact	Action
`chat.blueflyagents.com` already maps to `localhost:3080`	Open WebUI should use host port `3080`, not `3000`	Set compose bind to `127.0.0.1:3080:8080`
`chat.drupl.ai` also maps to `localhost:3080`	Same local origin may serve both Bluefly and Drupl chat if same tunnel host	Verify intended multi-domain routing before deploying
`docs.contractplane.ai` appears twice	Duplicate route	Reconcile later; not relevant to Wave 1
Several routes point to Tailnet hostnames	Tunnel already supports private network origins	Preserve; do not rewrite during Open WebUI deployment
Catch-all is `http_status:404`	Unmatched routes fail closed	Good default posture

Wave 1 deployment rule¶

Use existing route:
chat.blueflyagents.com -> http://localhost:3080

Deploy Open WebUI as:
127.0.0.1:3080:8080

Do not mutate Cloudflare Tunnel routes in Wave 1.