Cloudflared Access

[Devjean-piere]

Is your feature request related to a problem? Please describe.

I'm always frustrated when I try to use the mod for my server infrastructure and it doesn't work with servers protected by Cloudflare Access. My Minecraft server is exposed via a Cloudflare Tunnel with a Zero Trust Access application in front of it (role-based SSO policy). Modflared currently only handles plain tunnel connections and has no way to complete the Access authentication flow, so players (including myself) can't connect through it at all.

Describe the solution you'd like

Add support for Cloudflare Access-protected tunnels. Concretely:

• Modflared should detect (e.g. via a dedicated TXT record flag like cloudflared-use-access, similar to the existing cloudflared-use-tunnel/cloudflared-route convention) that a hostname requires Access authentication.
• If required, it should trigger a cloudflared access login <hostname> flow in the background instead of (or in addition to) the plain tunnel connection, opening the system browser for the SSO login.
• While waiting for the login to complete, the client should show some kind of status/prompt (e.g. "Waiting for browser login...") instead of just hanging or timing out silently.
• The resulting Access token should be cached locally and automatically refreshed when it expires, so players don't have to re-authenticate every session.

Describe alternatives you've considered

• Manually running cloudflared access tcp --hostname ... --url localhost:PORT outside of Minecraft and pointing the client at the local port. This works, but defeats the purpose of modflared (zero manual setup for players) and isn't practical for non-technical players.
• Using Service Tokens instead of interactive SSO login to avoid the browser flow entirely. This could be a simpler first step to support, though it trades per-user identity/audit logging for convenience.
• Switching to Cloudflare WARP with Zero Trust Gateway policies instead of Access. This moves authentication to the network layer, but requires every player to install and configure WARP separately, which has its own setup burden.

Additional context

My current tunnel ingress config already routes correctly:

ingress:
  - hostname: mc.example.de
    service: tcp://localhost:25565
  - service: http_status:404

The Access application in the Zero Trust dashboard uses a role-based policy via my SSO provider. Right now the only working path is manually running cloudflared access tcp as a local proxy client per player, which is the exact friction modflared is meant to eliminate.