Deploy Plane project management to k8s with Cloudflare Access gate

Adds all k8s manifests (namespace, postgres, redis, api, worker, beat, web, ingress, externalsecret, configmap, kustomization), Argo CD Application, and Cloudflare Zero Trust access policy for plane.neuralplatform.ai.
2026-04-24 14:21:02 -05:00
parent e901b9a541
commit 2d98df75ad
13 changed files with 438 additions and 0 deletions
@@ -0,0 +1,32 @@
+# Cloudflare Zero Trust Access — Plane project management
+# Protects plane.neuralplatform.ai with Google OAuth.
+
+locals {
+  plane_zone_id        = local.zone_neuralplatform_ai
+  plane_allowed_emails = [
+    "andersonwilliam85@gmail.com",
+    "1timlingo@gmail.com",
+  ]
+}
+
+resource "cloudflare_zero_trust_access_application" "plane" {
+  zone_id                   = local.plane_zone_id
+  name                      = "Plane"
+  domain                    = "plane.neuralplatform.ai"
+  type                      = "self_hosted"
+  session_duration          = "24h"
+  allowed_idps              = ["808f1913-5a8e-4a97-9e68-8ec58e362110"] # Google
+  auto_redirect_to_identity = true
+}
+
+resource "cloudflare_zero_trust_access_policy" "plane_allow" {
+  application_id = cloudflare_zero_trust_access_application.plane.id
+  account_id     = var.cloudflare_account_id
+  name           = "Allow Will and Tim"
+  precedence     = 1
+  decision       = "allow"
+
+  include {
+    email = local.plane_allowed_emails
+  }
+}