Cloudflare Access Policy Pack

Secure Your Internal Tools in Minutes

Your Grafana is one leaked password away from public access. Your Gitea repo is a misconfigured firewall from exploitation. This pack eliminates that risk with zero-trust identity policies in Terraform.

What's Included

• Pre-built Access applications for Grafana, Gitea, pgAdmin, and a generic admin panel
• Reusable policies: email One-Time-PIN (OTP), GitHub SSO, and service token authentication
• GitHub identity provider (optional; auto-created when needed)
• Service token for health checks and automation
• Production-ready configurations with sensible defaults (24h admin tool sessions, 4h for pgAdmin)

What You Get

• main.tf — Terraform provider block and GitHub identity provider resource
• apps.tf — Access application for_each loop (add apps by extending the map)
• policies.tf — Reusable email OTP, GitHub org, and service token policies
• variables.tf — Input variables (account_id, domain, email allowlist, GitHub secrets)
• outputs.tf — Application URLs and service token credentials
• terraform.tfvars.example — Pre-filled example for Grafana, Gitea, pgAdmin, Admin
• .gitignore — Excludes tfstate and sensitive files
• README.md — Setup, policy variants, adding more apps, troubleshooting

Requirements

• Cloudflare account with Zero Trust access (free tier or paid)
• Cloudflare API token (scopes: Access:Edit, Identity Providers:Edit)
• Terraform ≥ 1.5, Cloudflare provider ~> 5.0
• GitHub OAuth app (optional, only if using GitHub SSO variant)

How It Works

Each app references a policy variant (email_otp, github_org, or service_token). Policies are reusable and can be applied to multiple applications. Deploy once, then add apps by extending the apps variable—no policy rewrite needed. Session durations and launcher visibility are configurable per app.