Cloudflare Access setup — service-token auth for the app

Both tunnel hostnames must sit behind Cloudflare Access so the open internet cannot reach Ollama or SSH. The Kotlin app authenticates with a service token (Client ID + Client Secret) — programmatic, no browser login on the phone.

1. Create the Access applications

Cloudflare dashboard → Zero Trust → Access → Applications → Add an application → Self-hosted.

Create one for each hostname (replace yourdomain.com with your domain):

Application name	Domain
command-center-ollama	`ollama-internal.yourdomain.com`
command-center-ssh	`ssh.yourdomain.com`

Session duration: 24h is fine (service tokens are not interactive sessions).

2. Create the service token

Zero Trust → Access → Service Tokens → Create Service Token.

Name: kotlin-command-center
It shows a Client ID and Client Secret exactly once. Copy both now — the secret cannot be retrieved later (generate a new token if lost).

3. Attach the Allow policy to both applications

For each application → Policies → Add a policy:

Policy name: app-service-token
Action: Allow
Configure rules → Add require → Service Token → select kotlin-command-center
(Optional but recommended) Add an AND rule: IP ranges limited to the egress ranges you actually use, if they are stable.

Result: any request without a valid CF-Access-Client-Id / CF-Access-Client-Secret pair is rejected at the edge before it ever touches your tunnel.

4. Wire the secrets into the stack

Secret	Where it goes
Client ID + Client Secret	`worker/` via `wrangler secret put CF_CLIENT_ID` / `CF_CLIENT_SECRET` (Worker attaches them when calling the tunnel)
Client ID + Client Secret	Kotlin app config (`CC_CF_CLIENT_ID`, `CC_CF_CLIENT_SECRET`) — used on the SSH WebSocket handshake (`wss://ssh.yourdomain.com`)
`APP_SECRET` (you invent)	`wrangler secret put APP_SECRET` and the app's `CC_APP_SECRET` — authenticates the phone to the Worker

The phone never talks to ollama-internal.yourdomain.com directly; only the Worker holds the service token for that hostname. The phone uses the service token only for the SSH WebSocket handshake.

5. Rotation

Service token compromised or phone lost: Access → Service Tokens → delete the token and create a new one, then wrangler secret put the new values and update the app config. The old token stops working immediately.
APP_SECRET: pick a fresh 32+ byte random value (openssl rand -hex 32), rotate the same way.