Will Anderson
e901b9a541
- Deploy marketing site to neuron-stage namespace (replaces bare REST catch-all) - Staging uses test-mode Stripe keys from Vault - Updated stage ingress to match prod routing pattern (MCP paths + marketing at /) - Cloudflare Access: stage.neurontechnologies.ai requires Google auth - @neurontechnologies.ai domain allowed - 1timlingo@gmail.com explicitly allowed
44 lines
1.4 KiB
Terraform
44 lines
1.4 KiB
Terraform
# Cloudflare Zero Trust Access — stage.neurontechnologies.ai
|
|
# Protects the staging marketing site with Google OAuth.
|
|
# Only @neurontechnologies.ai addresses and Tim's personal Gmail are allowed in.
|
|
|
|
locals {
|
|
stage_allowed_emails = [
|
|
"1timlingo@gmail.com",
|
|
]
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_access_application" "nt_stage" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "Neuron Stage"
|
|
domain = "stage.neurontechnologies.ai"
|
|
type = "self_hosted"
|
|
session_duration = "24h"
|
|
allowed_idps = ["808f1913-5a8e-4a97-9e68-8ec58e362110"] # Google
|
|
auto_redirect_to_identity = true
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_access_policy" "nt_stage_allow_domain" {
|
|
application_id = cloudflare_zero_trust_access_application.nt_stage.id
|
|
account_id = var.cloudflare_account_id
|
|
name = "Allow neurontechnologies.ai domain"
|
|
precedence = 1
|
|
decision = "allow"
|
|
|
|
include {
|
|
email_domain = ["neurontechnologies.ai"]
|
|
}
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_access_policy" "nt_stage_allow_tim" {
|
|
application_id = cloudflare_zero_trust_access_application.nt_stage.id
|
|
account_id = var.cloudflare_account_id
|
|
name = "Allow Tim personal Gmail"
|
|
precedence = 2
|
|
decision = "allow"
|
|
|
|
include {
|
|
email = local.stage_allowed_emails
|
|
}
|
|
}
|