diff --git a/servers/legion/fornax-access.tf b/servers/legion/fornax-access.tf
new file mode 100644
index 0000000..2d91a43
--- /dev/null
+++ b/servers/legion/fornax-access.tf
@@ -0,0 +1,34 @@
+# Cloudflare Zero Trust Access — Fornax coordinator dashboard
+# Protects fornax.neuralplatform.ai with Google OAuth.
+# Sonarr/Radarr use the internal K8s service (fornax.media.svc) so they
+# are unaffected by this gate.
+
+locals {
+  fornax_zone_id        = "58d3e7ec2a4c1b191e6cfa93dd27c822"
+  fornax_allowed_emails = [
+    "andersonwilliam85@gmail.com",
+    "1timlingo@gmail.com",
+  ]
+}
+
+resource "cloudflare_zero_trust_access_application" "fornax" {
+  zone_id                   = local.fornax_zone_id
+  name                      = "Fornax"
+  domain                    = "fornax.neuralplatform.ai"
+  type                      = "self_hosted"
+  session_duration          = "24h"
+  allowed_idps              = ["808f1913-5a8e-4a97-9e68-8ec58e362110"] # Google
+  auto_redirect_to_identity = true
+}
+
+resource "cloudflare_zero_trust_access_policy" "fornax_allow" {
+  application_id = cloudflare_zero_trust_access_application.fornax.id
+  account_id     = var.cloudflare_account_id
+  name           = "Allow Will and Tim"
+  precedence     = 1
+  decision       = "allow"
+
+  include {
+    email = local.fornax_allowed_emails
+  }
+}