From 1fd04c104bcad3188001982e9810328163265636 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Thu, 16 Apr 2026 16:08:37 -0500 Subject: [PATCH] Add Cloudflare Zero Trust Access for fornax.neuralplatform.ai Google OAuth gate on the public dashboard. Allows andersonwilliam85@gmail.com and 1timlingo@gmail.com. Auto-redirects to Google; 24h session. Sonarr/Radarr use the internal cluster service so are unaffected. --- servers/legion/fornax-access.tf | 34 +++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 servers/legion/fornax-access.tf diff --git a/servers/legion/fornax-access.tf b/servers/legion/fornax-access.tf new file mode 100644 index 0000000..2d91a43 --- /dev/null +++ b/servers/legion/fornax-access.tf @@ -0,0 +1,34 @@ +# Cloudflare Zero Trust Access — Fornax coordinator dashboard +# Protects fornax.neuralplatform.ai with Google OAuth. +# Sonarr/Radarr use the internal K8s service (fornax.media.svc) so they +# are unaffected by this gate. + +locals { + fornax_zone_id = "58d3e7ec2a4c1b191e6cfa93dd27c822" + fornax_allowed_emails = [ + "andersonwilliam85@gmail.com", + "1timlingo@gmail.com", + ] +} + +resource "cloudflare_zero_trust_access_application" "fornax" { + zone_id = local.fornax_zone_id + name = "Fornax" + domain = "fornax.neuralplatform.ai" + type = "self_hosted" + session_duration = "24h" + allowed_idps = ["808f1913-5a8e-4a97-9e68-8ec58e362110"] # Google + auto_redirect_to_identity = true +} + +resource "cloudflare_zero_trust_access_policy" "fornax_allow" { + application_id = cloudflare_zero_trust_access_application.fornax.id + account_id = var.cloudflare_account_id + name = "Allow Will and Tim" + precedence = 1 + decision = "allow" + + include { + email = local.fornax_allowed_emails + } +}