Cloudflare Tunnel's origin service for img.riotpiao.com self-references the same public hostname (same pattern as paperless/forgejo/authentik) - without this rewrite, cloudflared's in-cluster DNS resolution has nowhere to loop back to, and TLS to the raw ingress-nginx service name fails cert validation (cert is only valid for *.riotpiao.com).