Cloudflare Tunnel Services
SF-AI tunnel · Token mode · 本機 Server → Cloudflare Edge
| Subdomain | Port | Server / App | Venv | Access | Status |
|---|---|---|---|---|---|
| portal.sf-hubs.dev | :5100 | Portal | — | No Access | ● Down |
| kb.sf-hubs.dev | :5003 | HKICPA KB (Flask · QwenPaw) | QwenPaw | No Access | ● Running |
| kb-legacy | :5002 | HKICPA KB (Flask · Hermes · Legacy) | Hermes | No Access | ● Running |
| dash.sf-hubs.dev | :8522 | Dashboard | — | No Access | ● Down |
| album.sf-hubs.dev | :5300 | Album Server (Starlette) | QwenPaw | No Access | ● Running |
| qwenpaw.sf-hubs.dev | :56101 | QwenPaw Desktop (NSSM Service) | Built-in | Email OTP | ● Running |
| bridge.sf-hubs.dev | :5555 | Bridge | — | No Access | ● Running |
| audit.sf-hubs.dev | :5101 | Audit Hub (portal_patched) | — | No Access | ● Running |
| pbc.sf-hubs.dev | :5200 | PBC | — | No Access | ● Running |
Cloudflare Pages & Workers
靜態部署 · 唔使 run local server · Git push auto-deploy
| Subdomain | Type | App | Deploy | Access |
|---|---|---|---|---|
| sf-hubs.dev | Pages | 主站 (9 Hubs) | Git push → auto | Public |
| fin.sf-hubs.dev | Pages | Finance Hub (QB companion) | Git push → auto | @prism.com.hk |
| mini-pc.sf-hubs.dev | Pages | AI Mini PC Tracker (17 models) | Wrangler deploy | Public |
| qb-api.stephenfch.workers.dev | Worker | QuickBooks OAuth Proxy | wrangler deploy | Public |
| cla-hk.com | Pages | CLA HK Landing (stephenfch/cla-hk-site) | Git push → auto | Public |
| audit.cla-hk.com | Pages | CLA Audit Hub → :5101 | Git push → auto | @prism.com.hk |
| kb.cla-hk.com | Pages | CLA Knowledge Base → :5003 | Git push → auto | @prism.com.hk |
Planned
已計劃但未部署
| Subdomain | Type | App | Host | Access |
|---|---|---|---|---|
| ai.sf-hubs.dev | Tunnel | EVO-X3 AI Portal (70B models) | GMKtec EVO-X3 | @prism.com.hk |
💡 EVO-X3 未買。買咗之後會 set up Ollama + FastAPI portal + Cloudflare Tunnel。
Architecture
Network topology — 邊部機、咩 tunnel、咩 port
flowchart TD
INET["🌐 Internet / Browser"]
CF["☁️ Cloudflare Edge
(DNS + SSL + CDN)"] INET --> CF CF --> CFP["📄 CF Pages
(Static)"] CF --> CFT["🚇 SF-AI Tunnel
(Token mode)
ID: 54ebfad6"] CFP --- CFP_LIST["sf-hubs.dev · fin.sf-hubs.dev
mini-pc.sf-hubs.dev
cla-hk.com · audit.cla-hk.com · kb.cla-hk.com"] style CFP_LIST fill:#0f0f18,stroke:#38bdf8,color:#38bdf8,font-size:11px CFT --> ROUTES subgraph ROUTES ["Published Application Routes"] direction LR R1["portal
:5100"] R2["kb-legacy
:5002"] R2b["kb
:5003"] R3["dash
:8522"] R4["album
:5300"] R5["qwenpaw
:56101"] R6["bridge
:5555"] R7["audit
:5101"] R8["pbc
:5200"] end subgraph DESKTOP ["🖥️ Stephen's Desktop (RTX 5070)"] direction LR S1["Portal
Flask"] S2["HKICPA KB
Flask · Hermes"] S2b["HKICPA KB
QwenPaw venv"] S3["Dashboard
Streamlit"] S4["Album Server
Starlette"] S5["QwenPaw
NSSM Service
:56101"] S6["Bridge
127.0.0.1"] S7["Audit Hub
portal_patched"] S8["PBC
Flask"] end ROUTES --> DESKTOP TS["🔗 Tailscale Mesh VPN
100.71.102.76:56101
(PRC fallback)"] TS --> S5 style TS fill:#0f0f18,stroke:#22c55e,color:#22c55e CW["⚡ CF Workers
qb-api.stephenfch.workers.dev
QuickBooks OAuth Proxy"] style CW fill:#0f0f18,stroke:#38bdf8,color:#38bdf8 style INET fill:#0a0a0f,stroke:#818cf8,color:#e0e7ff style CF fill:#0a0a0f,stroke:#818cf8,color:#e0e7ff style CFP fill:#0f0f18,stroke:#38bdf8,color:#38bdf8 style CFT fill:#0f0f18,stroke:#22c55e,color:#22c55e style DESKTOP fill:#12121a,stroke:#6366f1,color:#e0e7ff style ROUTES fill:#0a0a0f,stroke:#6366f1,color:#e0e7ff
(DNS + SSL + CDN)"] INET --> CF CF --> CFP["📄 CF Pages
(Static)"] CF --> CFT["🚇 SF-AI Tunnel
(Token mode)
ID: 54ebfad6"] CFP --- CFP_LIST["sf-hubs.dev · fin.sf-hubs.dev
mini-pc.sf-hubs.dev
cla-hk.com · audit.cla-hk.com · kb.cla-hk.com"] style CFP_LIST fill:#0f0f18,stroke:#38bdf8,color:#38bdf8,font-size:11px CFT --> ROUTES subgraph ROUTES ["Published Application Routes"] direction LR R1["portal
:5100"] R2["kb-legacy
:5002"] R2b["kb
:5003"] R3["dash
:8522"] R4["album
:5300"] R5["qwenpaw
:56101"] R6["bridge
:5555"] R7["audit
:5101"] R8["pbc
:5200"] end subgraph DESKTOP ["🖥️ Stephen's Desktop (RTX 5070)"] direction LR S1["Portal
Flask"] S2["HKICPA KB
Flask · Hermes"] S2b["HKICPA KB
QwenPaw venv"] S3["Dashboard
Streamlit"] S4["Album Server
Starlette"] S5["QwenPaw
NSSM Service
:56101"] S6["Bridge
127.0.0.1"] S7["Audit Hub
portal_patched"] S8["PBC
Flask"] end ROUTES --> DESKTOP TS["🔗 Tailscale Mesh VPN
100.71.102.76:56101
(PRC fallback)"] TS --> S5 style TS fill:#0f0f18,stroke:#22c55e,color:#22c55e CW["⚡ CF Workers
qb-api.stephenfch.workers.dev
QuickBooks OAuth Proxy"] style CW fill:#0f0f18,stroke:#38bdf8,color:#38bdf8 style INET fill:#0a0a0f,stroke:#818cf8,color:#e0e7ff style CF fill:#0a0a0f,stroke:#818cf8,color:#e0e7ff style CFP fill:#0f0f18,stroke:#38bdf8,color:#38bdf8 style CFT fill:#0f0f18,stroke:#22c55e,color:#22c55e style DESKTOP fill:#12121a,stroke:#6366f1,color:#e0e7ff style ROUTES fill:#0a0a0f,stroke:#6366f1,color:#e0e7ff
✅ bridge:5555 fixed — now bound to 127.0.0.1 (was 0.0.0.0, resolved 2026-08-04)
⚡
CF Workers
qb-api.stephenfch.workers.dev
QuickBooks OAuth Proxy
Key Info
重要配置同注意事項
🚇 Tunnel 狀態
SF-AI (54ebfad6)
Healthy
pbc-uploader (bdc72825)
Healthy
sfhubs-bridge (ca822f7a)
Healthy
⚠️ 實際跑緊嘅係 SF-AI。Token mode = Dashboard 管理 ingress。
🐍 Python Venvs
QwenPaw venv
~/.qwenpaw.venv
album, weather, general Python
Hermes venv
hermes-agent-env
HKICPA KB :5002 (legacy · hermes chat backend)
QwenPaw venv
~/.qwenpaw/venv
HKICPA KB :5003 (primary · qwenpaw agent) · album · weather
🔒 Cloudflare Access
qwenpaw
stephenfch@gmail.com
fin
@prism.com.hk
其他 subdomain 暫時冇 Access 保護。
🔗 Tailscale Mesh VPN
sf-desktop
100.71.102.76
synology-sf
100.85.156.33
fan--s26-ultra
100.101.249.123
sf-prc
100.84.172.95
🔥 QwenPaw: http://100.71.102.76:56101
PRC fallback when Cloudflare Tunnel blocked.
⚙️ NSSM Services
QwenPaw
:56101 Auto
QwenPaw_Portal_*
Stopped
QwenPaw service: qwenpaw.exe app --port 56101
Auto-start on Windows boot. Firewall: Tailscale only.
☁️ Cloudflare Account
Zone: sf-hubs.dev
Zone: cla-hk.com
Account: 2ba4518a...
Nameservers: kanye + lila.ns.cloudflare.com
Plan: Free
🇭🇰 CLA Hong Kong Portal
cla-hk.com
Pages
audit.cla-hk.com
→ :5101
kb.cla-hk.com
→ :5003
Repo: stephenfch/cla-hk-site
Deploy: Cloudflare Pages (Git push → auto)
5101: Audit Hub (portal_patched · QwenPaw)
5003: HKICPA KB (Flask · QwenPaw agent)
Server Startup Commands
每個 server 點樣手動啟動
🖼️ Album Server
localhost:5300
C:\Users\Win 11\.qwenpaw.venv\Scripts\python3.11.exe C:\Users\Win 11\Desktop\sf-hubs\scripts\album_server.py
📚 HKICPA Knowledge Base
localhost:5003
PRIMARY
cd "C:\Users\Win 11\Desktop\CLA Hong Kong - Audit Hubs\hkicpa_kb_qwenpaw" && "C:\Users\Win 11\.qwenpaw\venv\Scripts\python.exe" -m src.app
✅ QwenPaw venv · agent 小雯 (vSejrt) · POST /api/console/chat · 獨立 DB
📚 HKICPA KB (Legacy)
localhost:5002
LEGACY
cd "C:\Users\Win 11\Desktop\CLA Hong Kong - Audit Hubs\hkicpa_kb" && python -m src.app
⚠️ Hermes venv · hermes subprocess backend
🤖 QwenPaw Desktop
localhost:56101
NSSM SERVICE
C:\Tools\NSSM\nssm.exe start QwenPaw
# Auto-start on Windows boot
# Fixed port 56101
# Firewall: Tailscale 100.64.0.0/10 only
✅ NSSM service · Auto-start · Cloudflare Tunnel + Tailscale fallback
🌉 Bridge / 🏢 Audit Hub / 📦 PBC
:5555 / :5101 / :5200
需要確認各自嘅啟動方式（config.yml 中有 mapping 但 server 進程未知）