Skip to main content

Cloudflare Access

This docs site describes production topology, ports, and failure modes. It is internal.

  1. Create the Pages project splick-docs.
  2. Attach the hostname you chose (the site config uses https://docs.splick.app as the canonical URL; change url in docusaurus.config.ts if the real hostname differs).
  3. In Cloudflare Zero Trust, create an Access application for that hostname.
  4. Allow only the team identity provider (for example the company Google account domain).
  5. Do not put a bypass for the whole site. A bypass for a single health path is unnecessary because Pages serves static files.
  6. Keep the API (api.splick.app) public. Access in front of the API would break the mobile apps.

The GitHub Actions workflow deploys the site. Access is a dashboard setting, not a line in the workflow. Review it when the project is created and again if someone adds a custom domain.

Preview URLs on pull requests should use the same Access application or stay unpublished. A public preview of the runbooks is the same leak as a public production site.