Add tunnel option to app.run

[ndrezn]

Adds app.run(tunnel=True) (or DASH_TUNNEL=1) to share a locally running app on a public trycloudflare.com URL through a Cloudflare quick tunnel. No account or login needed. For development only.

• Uses cloudflared from the PATH, otherwise downloads the latest release once into ~/.cache/dash/cloudflared.
• The public URL is logged next to the local one and stays the same across hot reloads.
• If the tunnel fails to start, the app still runs locally.
• cloudflared is stopped on exit, including SIGTERM.
• Warns when debug is on, since dev tools and tracebacks become public.

Closes #4029

[robertclaus]

This PR is missing an issue to discuss the problem you're running into. Tsk tsk tsk @ndrezn. ;)

Note, this type of developer tooling should probably go into the plotly CLI, not core Dash. We should also be careful automatically downloading, installing, and executing executables without confirming with the user. Realistically, it probably also needs some additional research to see what other tunnel services folks prefer (ex. ngrok).

[ndrezn]

Ticket opened. ngrok isn't an option unfortunately as you need an account to spin up a tunnel. This design isn't original, there's a good similar no-config example in langchain linked in the ticket, if you're curious about whether this design is adopted in other frameworks.

Feel free to move this over to the plotly CLI, it's closed source though, so I won't be able to help. I do think it would be useful in core Dash, and then the CLI could expose this as a flag as it does for run commands etc. This way the solution is implemented further upstream.

[ndrezn]

Added download confirmation if the binary doesn't exist & version pin for the binary for good measure

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[T4rk1n]

I am not sure we want this baked in the framework, it's convenient, but then I can just ask an agent to open a tunnel for me for the same result.
There's also a risk about exposing a development app to the public the user should know about before starting these, these cloudflared apps get scanned almost instantly.
It's also tied to a third party who may decide to change the service, it happened with ngrok, it was free for a while but now requires an account and limit usages.

[ndrezn]

Fair on possible vendor shifts; I've found it super handy as a built-in in general for development. Even if an agent can do this I suspect many developers haven't tried these tools with Dash, which makes discoverability low. I could refactor to make this less locked to Cloudflare and therefore easier to swap out in the future.

[ndrezn]

Discussed between the Dash maintainers and we don't think the current implementation is secure enough to recommend to Dash developers in Enterprise settings. We're going to look into adding a docs page to recommend it and investigate adding a tunnel relay server in Plotly Cloud + Dash Enterprise so we can provide end-to-end encryption.

From @robertclaus in #4028

Looking forward to seeing the implementation from Plotly folks!