# Cloudflare Zero Trust Access — Fornax coordinator dashboard
# Protects fornax.neuralplatform.ai with Google OAuth.
# Sonarr/Radarr use the internal K8s service (fornax.media.svc) so they
# are unaffected by this gate.

locals {
  fornax_zone_id        = local.zone_neuralplatform_ai
  fornax_allowed_emails = [
    "andersonwilliam85@gmail.com",
    "1timlingo@gmail.com",
  ]
}

resource "cloudflare_zero_trust_access_application" "fornax" {
  zone_id                   = local.fornax_zone_id
  name                      = "Fornax"
  domain                    = "fornax.neuralplatform.ai"
  type                      = "self_hosted"
  session_duration          = "24h"
  allowed_idps              = ["808f1913-5a8e-4a97-9e68-8ec58e362110"] # Google
  auto_redirect_to_identity = true
}

resource "cloudflare_zero_trust_access_policy" "fornax_allow" {
  application_id = cloudflare_zero_trust_access_application.fornax.id
  account_id     = var.cloudflare_account_id
  name           = "Allow Will and Tim"
  precedence     = 1
  decision       = "allow"

  include {
    email = local.fornax_allowed_emails
  }
}