From d836577704ed3521adcab4991711738561c6d103 Mon Sep 17 00:00:00 2001
From: ncaq <ncaq@ncaq.net>
Date: Tue, 12 May 2026 18:38:59 +0900
Subject: [PATCH] nixos/cloudflared: add per-tunnel protocol option

cloudflared defaults to QUIC.
On networks with restrictive UDP handling, or in the face of QUIC interop bugs, this can be unreliable.
For example, see https://github.com/zhaofengli/attic/issues/281.
The only declarative workaround so far has been to wrap `cloudflared` in a shell script that injects `--protocol http2`.

Add a per-tunnel `protocol` option (enum of `auto`/`http2`/`quic`).
It sets `TUNNEL_TRANSPORT_PROTOCOL` on the systemd service, mirroring the existing `edgeIPVersion` option.

The default `auto` preserves current behaviour.
cloudflared treats `TUNNEL_TRANSPORT_PROTOCOL=auto` like omitting the flag, so existing configurations are unaffected.
---
 .../services/networking/cloudflared.nix       | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/nixos/modules/services/networking/cloudflared.nix b/nixos/modules/services/networking/cloudflared.nix
index 37889c7308da..26662e563356 100644
--- a/nixos/modules/services/networking/cloudflared.nix
+++ b/nixos/modules/services/networking/cloudflared.nix
@@ -240,6 +240,25 @@ in
                 example = "auto";
               };
 
+              protocol = lib.mkOption {
+                type = lib.types.enum [
+                  "auto"
+                  "http2"
+                  "quic"
+                ];
+                default = "auto";
+                description = ''
+                  Specifies the protocol used to establish a connection between `cloudflared` and the Cloudflare global network.
+
+                  The value `auto` lets `cloudflared` choose the protocol (currently QUIC, falling back to HTTP/2).
+                  Set to `http2` to work around QUIC/UDP connectivity issues, such as restrictive firewalls, broken UDP path MTU, or QUIC interop bugs.
+                  Set to `quic` to force QUIC.
+
+                  See [Tunnel run parameters](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/cloudflared-parameters/run-parameters/#protocol).
+                '';
+                example = "http2";
+              };
+
               default = lib.mkOption {
                 type = lib.types.str;
                 description = ''
@@ -397,6 +416,7 @@ in
         environment = {
           TUNNEL_ORIGIN_CERT = lib.mkIf (certFile != null) "%d/cert.pem";
           TUNNEL_EDGE_IP_VERSION = tunnel.edgeIPVersion;
+          TUNNEL_TRANSPORT_PROTOCOL = tunnel.protocol;
         };
       }
     ) config.services.cloudflared.tunnels;