Docs

Provision family.wofford.dev

Private photos stay off signal.wofford.dev. Put them on a dedicated hostname, reach them through a Cloudflare Tunnel, and gate them with Access (email OTP, optional device certs).

Device → Access → Tunnel → localhost gallery

1. Create a Tunnel

• Cloudflare One → Networks → Tunnels → Create (Cloudflared). Name it e.g. family-vault.
• Install cloudflared on the photo host with the dashboard token.
• Confirm tunnel status is Healthy.

2. Publish the hostname

• Add a public hostname: family.wofford.dev → http://localhost:<gallery-port>.
• Cloudflare creates a proxied CNAME to *.cfargotunnel.com.
• Bind Immich/Nextcloud/nginx to localhost only — no router port-forward.

3. Access + email OTP

• Access controls → Applications → Self-hosted → domain family.wofford.dev.
• Policy: Allow → Include emails on your family allowlist.
• Login method: One-time PIN (enabled under Settings → Authentication).
• Optional Require: Country = United States. Session: ~24h to start.

4. Optional device certs

• Access mTLS (custom CA) is plan-dependent. If unavailable, keep OTP or use WARP + device posture instead.
• When available: upload root CA under Service credentials → Mutual TLS, associate family.wofford.dev, policy Include → Valid Certificate.
• Install client certs on household devices; keep OTP as a second Allow policy for guests.

5. Harden

• Enable WAF on the zone; review Access logs periodically.
• Never put kids’ media in the signal Worker or this git repo.
• Verify: allowlisted OTP works; unlisted email is denied; portfolio CTA at /family opens the vault.

Full checklist and troubleshooting: docs/cloudflare-access.md · Family vault overview