Cloudflare Access (Zero Trust)

Convertella uses Cloudflare Access at the edge for production pilot hostnames and Cloudflare preview URLs. The platform script scripts/cloudflare-access-zero-trust.mjs creates or updates Access applications and allow policies via API (requires CLOUDFLARE_API_TOKEN with Access: Apps and Policies — Edit).

Protected hostnames (production)

Hostname	Application	Service token allowed
`docs.convertella.app`	Handbook (Cloudflare Pages)	Yes (for AI / automation)
`ops.convertella.app`	Operator console — production (Worker)	No
`demo.convertella.app`	Buyer portal — testing (Worker)	No
`demo-ops.convertella.app`	Operator console — testing (Worker)	No

demo-crm.convertella.app (testing CRM) and convertella.app (production CRM) use Lucia OTP only — not Cloudflare Access at the edge.

The operator hostname ops.convertella.app is now recognized by hostname-policy.ts via the OPERATOR_HOSTNAMES export from config/cloudflare-projects.mjs (workstream 1.2). Previously, only the Worker-name-based hostname-policy path was active; now both paths are wired.

Protected preview URLs

Hostname	Application	Service token allowed
`convertella-handbook.pages.dev`	Handbook (Pages default URL)	Yes
`convertella-platform.<account>.workers.dev`	Platform Worker preview	No
`convertella-operator.<account>.workers.dev`	Operator Worker preview	No

Branch-specific Pages preview URLs (<hash>.convertella-handbook.pages.dev) should use Pages → project → Settings → Enable access policy in the dashboard so all preview deployments require Access.

The agent CRM (convertella.app) is not behind Access; it uses Lucia OTP only. Pilot buyer and operator URLs require Access first, then normal app auth (buyer OTP / operator JWT) behind the edge.

Operator allow list

Default allow-listed emails (override with CF_ACCESS_OPERATOR_EMAILS):

josef@convertella.app
julia.dietz@convertella.com
melanie.moser@convertella.com

Apply / audit configuration

cd platform
node --env-file=.env scripts/cloudflare-access-zero-trust.mjs          # apply
node --env-file=.env scripts/cloudflare-access-zero-trust.mjs --dry-run  # preview
node --env-file=.env scripts/cloudflare-access-audit.mjs                 # read-only vs config

Service token for handbook automation

To let tools (e.g. support-ticket AI) fetch live handbook HTML:

Run scripts/cloudflare-access-zero-trust.mjs --create-docs-service-token once.
Store client_id and client_secret from .deploy-state/docs-access-service-token.json in a secret manager.
Re-run the script so the docs.convertella.app policy includes the token (or uses any_valid_service_token until a dedicated token is bound).

Send headers on each HTTP request:

CF-Access-Client-Id
CF-Access-Client-Secret

Access still applies; the token is an allowed identity, not a public bypass.