Two changes so off-network wallet scanning actually works:
- Force the cloudflared edge connection over http2 (TCP/443) instead of
QUIC (UDP/7844) in both the Docker tunnel and the dev-tunnel script.
QUIC is blocked on many networks/Docker setups, which left the tunnel
stuck "Failed to dial a quic connection" and the QR pointing at a dead
URL — the root cause of "must be on the same network" failures.
- Gate the discovered quick-tunnel URL on real end-to-end reachability:
poll the tunnel's own /health until it answers (Cloudflare 1033 clears
in ~30s) before publishing it, and have /pair await that discovery so
the QR never carries a not-yet-live URL.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add `npm run docker:tunnel` (docker-compose.tunnel.yml overlay): a
cloudflared sidecar opens a public quick tunnel to the backend, and the
backend auto-discovers its https://…trycloudflare.com URL from cloudflared's
metrics endpoint (services/relay-url.ts) and bakes it into the wallet-import
QR — so a phone on any network can scan, with no install/account/PUBLIC_RELAY_URL.
PUBLIC_RELAY_URL still wins when set. Verified end-to-end: the backend logs
the discovered tunnel URL on startup.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Khalid Abdi