Add staging marketing site and Cloudflare Access gate

- Deploy marketing site to neuron-stage namespace (replaces bare REST catch-all) - Staging uses test-mode Stripe keys from Vault - Updated stage ingress to match prod routing pattern (MCP paths + marketing at /) - Cloudflare Access: stage.neurontechnologies.ai requires Google auth - @neurontechnologies.ai domain allowed - 1timlingo@gmail.com explicitly allowed
2026-04-24 13:43:06 -05:00
parent 477af9b673
commit e901b9a541
5 changed files with 194 additions and 2 deletions
@@ -0,0 +1,43 @@
+# Cloudflare Zero Trust Access — stage.neurontechnologies.ai
+# Protects the staging marketing site with Google OAuth.
+# Only @neurontechnologies.ai addresses and Tim's personal Gmail are allowed in.
+
+locals {
+  stage_allowed_emails = [
+    "1timlingo@gmail.com",
+  ]
+}
+
+resource "cloudflare_zero_trust_access_application" "nt_stage" {
+  zone_id                   = local.zone_neurontechnologies_ai
+  name                      = "Neuron Stage"
+  domain                    = "stage.neurontechnologies.ai"
+  type                      = "self_hosted"
+  session_duration          = "24h"
+  allowed_idps              = ["808f1913-5a8e-4a97-9e68-8ec58e362110"] # Google
+  auto_redirect_to_identity = true
+}
+
+resource "cloudflare_zero_trust_access_policy" "nt_stage_allow_domain" {
+  application_id = cloudflare_zero_trust_access_application.nt_stage.id
+  account_id     = var.cloudflare_account_id
+  name           = "Allow neurontechnologies.ai domain"
+  precedence     = 1
+  decision       = "allow"
+
+  include {
+    email_domain = ["neurontechnologies.ai"]
+  }
+}
+
+resource "cloudflare_zero_trust_access_policy" "nt_stage_allow_tim" {
+  application_id = cloudflare_zero_trust_access_application.nt_stage.id
+  account_id     = var.cloudflare_account_id
+  name           = "Allow Tim personal Gmail"
+  precedence     = 2
+  decision       = "allow"
+
+  include {
+    email = local.stage_allowed_emails
+  }
+}