War Room · explain the tech · any age

How the forever play link works

Think of https://play.sinmuela.org as a sandwich. Your phone is the top bun. The game is the filling. Everything in between is how the bite reaches the kitchen.

Right now: play.sinmuela.org → LIVE (same game as the lab computer)
Layer 1 · Top bun

Phone or browser

You open https://play.sinmuela.org. The little padlock means the trip is encrypted — that’s HTTPS, handled at the Cloudflare door (next layer).

You are here
Layer 2 · Global door

Cloudflare edge

Servers all over the world that answer first. They check the name, keep the padlock happy, and pass the request toward our tunnel — not toward José’s laptop.

Edge · CDN · HTTPS
Layer 3 · Secret pipe

Named Tunnel

A private pipe from Cloudflare into the Cursor cloud computer. Software called cloudflared keeps that pipe open. No one has to open scary holes in a home router.

cloudflared on Cursor VM
Layer 4 · The map

Public Hostname / ingress

A short rule that says: “When someone asks for play on sinmuela.org, send them to localhost:8000 on this machine.” Without this map, the pipe is healthy but the doorbell doesn’t ring.

play → localhost:8000
Layer 5 · Name tag

DNS

The internet’s phone book: which tunnel owns the name play.sinmuela.org? Tonight’s bug was simple and brutal — the name pointed at a dead tunnel. Fix the name tag; the door works again.

Must point at the live tunnel
Layer 6 · Kitchen

Lab server (server.py :8000)

A small Python server on the Cursor machine. It serves the hub pages and the Godot web build — the same files you’d see at http://127.0.0.1:8000 inside the lab.

Origin · hub + game files
Layer 7 · The meal

Godot · Moshpit Elite

The actual game — Arcade path, puppets, music, the pit. Everything above exists so this layer can load in a normal browser.

Arcade Complete lock stands

Why HTTP inside, HTTPS outside?

On the lab computer, the game listens as plain http://localhost:8000 — like talking to yourself in the kitchen.

Your phone talks to Cloudflare with HTTPS (the padlock). Cloudflare unwraps that safe trip, then walks the short hallway to localhost:8000 over the tunnel. You get a lock in the browser; the kitchen stays simple.

Why five bots struggled (one soft sentence)

Most bots can’t click José’s Cloudflare dashboard, and a green “Healthy” badge only means the pipe is open — not that the public name is wired — so good intentions still walked past the real switch.

One place to change the domain later

coordination/PUBLIC_ORIGIN.json (also GET /api/public-origin) is the single source of truth. Change the forever domain there — bots and pages should read it, not invent a sibling URL in chat.