From 7ff4590722c077cf743865a6734af1fab735678c Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Fri, 20 Mar 2026 01:18:29 +0100
Subject: [PATCH] Disable Cloudflare proxy for Minecraft record to allow direct
 client connections.

---
 nix-system-configs/modules/system/traefik.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix
index ae450e8..724aaf1 100644
--- a/nix-system-configs/modules/system/traefik.nix
+++ b/nix-system-configs/modules/system/traefik.nix
@@ -842,6 +842,17 @@ in {
           else
             export record_name="$r.${domain}"
           fi
+
+          # Default to Cloudflare proxy enabled for all records, but explicitly
+          # disable the proxy for the Minecraft record so clients connect
+          # directly to the origin on port 25565 (Cloudflare does not proxy
+          # arbitrary Minecraft TCP without Spectrum).
+          if [ "$r" = "minecraft" ]; then
+            export proxy="false"
+          else
+            export proxy="true"
+          fi
+
           # Invoke the single-run script explicitly with the system's bash via env to avoid /bin/bash shebang issues
           ${pkgs.bash}/bin/bash /etc/cloudflare-ddns/update-single.sh "$record_name" "$zone_identifier" "$auth_email" "$auth_key" || true
         done