A javascriptless check was released recently I just read about it. Uses some refresh HTML tag and a delay. Its not default though since its new.

As long as its not configured improperly. When forgejo devs added it it broke downloading images with Kubernetes for a moment. Basically would need to make sure user agent header for federation is allowed.

If you are still using the setup in the post with what I suggested that’d probably be why. You wouldn’t need a tunnel container anymore, host networking, nor DNS settings. Just a web service that you want to expose. Is the host able to resolve the same domains properly?

Not trying to subvert your issue but why not use something that makes the tunnel an easy to make ingress the kubernetes way? I don’t use cf tunnels so I havent use this but it seems to be a proper solution.

https://github.com/STRRL/cloudflare-tunnel-ingress-controller

Edit: An operator linked in that github project could be useful too if you want to support udp and such https://github.com/adyanth/cloudflare-operator