[Unit]
Description=Pangolin cloudflared (control-plane API tunnel → 127.0.0.1:8080)
Documentation=https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/
After=network-online.target pangolin-server.service
Wants=network-online.target

[Service]
Type=notify
# TUNNEL_TOKEN 从此文件注入(不入 unit 本体、不进 ps);cloudflared 自动读取 env TUNNEL_TOKEN。
EnvironmentFile=/etc/pangolin/cloudflared.env
ExecStart=/usr/local/bin/cloudflared --no-autoupdate tunnel run
Restart=on-failure
RestartSec=5
# 出站隧道,无需 root:用非特权用户即可(与 pangolin-server 同用户)。
User=pangolin
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target