# workers-discussions
- c
Cyb3r-Jok3
04/01/2023, 2:32 AMTunnel is going to be easiest - c
chientrm
04/01/2023, 2:42 AMI added a tunnel using my custom domain - c
chientrm
04/01/2023, 2:42 AMbut when I access the api with that domain. - c
chientrm
04/01/2023, 2:42 AMthe
isreq.urlhttps://worker.*.workers.dev - c
chientrm
04/01/2023, 2:43 AMnot my custom domain. - c
Cyb3r-Jok3
04/01/2023, 2:44 AMOh sorry didn't realize you were using the url. Not sure if you change that, given the way that dev works. Maybe try local mode with the tunnel - c
chientrm
04/01/2023, 2:44 AMbecause I need to
from my worker to an another service on the same root domain.fetch - c
chientrm
04/01/2023, 2:45 AMand that service cors is off. - c
Cyb3r-Jok3
04/01/2023, 2:45 AMAre you not using service bindings? - c
chientrm
04/01/2023, 2:45 AMoops - c
chientrm
04/01/2023, 2:46 AMthe other service's running with NodeJS. will it work? - c
Cyb3r-Jok3
04/01/2023, 2:46 AMAh nope that won't work service bindings only work between workers. Hopefully someone else has an idea on how to get it working - c
chientrm
04/01/2023, 2:47 AMso, my core api's running on a vps. my outer-layer api runs on worker. - c
chientrm
04/01/2023, 2:47 AMI found this guide: https://github.com/brettscott/cloudflare-worker-tunnel-mysql-example - c
chientrm
04/01/2023, 2:50 AMI do this but the
turn the application login page šres - c
chientrm
04/01/2023, 2:50 AMany chance it's about cors? - c
Cyb3r-Jok3
04/01/2023, 2:57 AMIs the worker running on the same domain as an access policy? - c
chientrm
04/01/2023, 2:57 AMyes they are - c
Cyb3r-Jok3
04/01/2023, 2:58 AMAccess polices are before workers so you'd need to make the worker call a different subdomain that is protected by access - c
chientrm
04/01/2023, 3:01 AMI solved it. - c
chientrm
04/01/2023, 3:02 AMit's about policy type. - c
chientrm
04/01/2023, 3:02 AMwhen create application policy, there's a combobox to select
, I change it toPolicy Type
and choose the service token I created. Now it work as intended.Service Token - c
chientrm
04/01/2023, 3:03 AMBy default, policy type is
.Allow - c
chientrm
04/01/2023, 3:03 AMIt even works when I browse worker using
.localhost - c
chientrm
04/01/2023, 3:42 AMOne more thing. When piping stream output from external service -> worker -> client, the streaming pipe can last up to minutes. Does it count toward worker runtime limit? š¤ - k
kian
04/01/2023, 3:54 AMDepends if the Worker is generating the output or if itās from another service like KV/R2 or a fetch subrequest - c
chientrm
04/01/2023, 3:55 AMthe other fetch subrequest generate output, worker doesn't interfere with the output. - k
kian
04/01/2023, 3:56 AMAs long as itās returned as-is and the body isnāt being transformed, the Workers can be evicted and so once the headers are sent (and youāre not doing any waitUntil work) the limits stop counting as that Worker invocation is gone - k
kian
04/01/2023, 4:03 AM - c
chientrm
04/01/2023, 4:07 AMtysm