Private · Cloudflare Access

Family vault

Children's photos and family albums are not hosted on the public portfolio. They live on a dedicated subdomain gated by Cloudflare Zero Trust — one-time passcodes for guests, or mutual TLS certificates on family devices.

Open family.wofford.dev Setup guide

01

Separate origin

Private media stays on family.wofford.dev (or a tunnel hostname), never mixed into the public Worker assets for signal.wofford.dev.

02

OTP for people

Cloudflare Access email one-time PIN for family members who need temporary or shared access without installing anything.

03

Certs for devices

Issue short-lived or device-bound client certificates to phones and laptops you trust — Access policies can require a valid cert before the album loads.

Policy sketch

Recommended Access rules

  1. 1 Create an Access application for family.wofford.dev.
  2. 2 Allow emails on your family allowlist via One-time PIN.
  3. 3 Add a second policy requiring a Cloudflare-issued client certificate for household devices.
  4. 4 Serve the gallery from a Cloudflare Tunnel to a home NAS or private object store — no public bucket.

This page is public on purpose: it explains the model without exposing any photos. Until family.wofford.dev is provisioned, the button above may not resolve.