| # Cloudflare Access setup — service-token auth for the app |
|
|
| Both tunnel hostnames must sit behind Cloudflare Access so the open internet |
| cannot reach Ollama or SSH. The Kotlin app authenticates with a **service |
| token** (Client ID + Client Secret) — programmatic, no browser login on the |
| phone. |
|
|
| ## 1. Create the Access applications |
|
|
| Cloudflare dashboard → **Zero Trust → Access → Applications → Add an application → Self-hosted**. |
|
|
| Create one for each hostname (replace `yourdomain.com` with your domain): |
|
|
| | Application name | Domain | |
| |---|---| |
| | command-center-ollama | `ollama-internal.yourdomain.com` | |
| | command-center-ssh | `ssh.yourdomain.com` | |
|
|
| Session duration: 24h is fine (service tokens are not interactive sessions). |
|
|
| ## 2. Create the service token |
|
|
| **Zero Trust → Access → Service Tokens → Create Service Token.** |
|
|
| - Name: `kotlin-command-center` |
| - It shows a **Client ID** and **Client Secret** exactly once. Copy both now — |
| the secret cannot be retrieved later (generate a new token if lost). |
|
|
| ## 3. Attach the Allow policy to both applications |
|
|
| For each application → **Policies → Add a policy**: |
|
|
| - Policy name: `app-service-token` |
| - Action: **Allow** |
| - Configure rules → **Add require → Service Token** → select `kotlin-command-center` |
| - (Optional but recommended) Add an `AND` rule: **IP ranges** limited to the |
| egress ranges you actually use, if they are stable. |
|
|
| Result: any request without a valid `CF-Access-Client-Id` / |
| `CF-Access-Client-Secret` pair is rejected at the edge before it ever touches |
| your tunnel. |
|
|
| ## 4. Wire the secrets into the stack |
|
|
| | Secret | Where it goes | |
| |---|---| |
| | Client ID + Client Secret | `worker/` via `wrangler secret put CF_CLIENT_ID` / `CF_CLIENT_SECRET` (Worker attaches them when calling the tunnel) | |
| | Client ID + Client Secret | Kotlin app config (`CC_CF_CLIENT_ID`, `CC_CF_CLIENT_SECRET`) — used on the **SSH WebSocket handshake** (`wss://ssh.yourdomain.com`) | |
| | `APP_SECRET` (you invent) | `wrangler secret put APP_SECRET` and the app's `CC_APP_SECRET` — authenticates the phone to the Worker | |
|
|
| The phone never talks to `ollama-internal.yourdomain.com` directly; only the |
| Worker holds the service token for that hostname. The phone uses the service |
| token only for the SSH WebSocket handshake. |
|
|
| ## 5. Rotation |
|
|
| - Service token compromised or phone lost: **Access → Service Tokens → delete** |
| the token and create a new one, then `wrangler secret put` the new values and |
| update the app config. The old token stops working immediately. |
| - `APP_SECRET`: pick a fresh 32+ byte random value |
| (`openssl rand -hex 32`), rotate the same way. |
|
|
