cloudflare-access — the front door for every internal app (Zero Trust free plan)¶
Team embeddedera (auth domain embeddedera.cloudflareaccess.com). One login method: Google,
IdP named "EmbeddedEra Workspace" (OAuth client "Cloudflare Access" in GCP project embeddedera,
consent Internal → only @embeddedera.com accounts). One allow policy, copied onto every app:
adiaz@embeddedera.com, angelgdo7@gmail.com, yrosado@embeddedera.com. Onboarding never edits a gate by hand: onboard access-sync reconciles every gate to
people.yml × the department access: tokens (hourly cron, daily drift alert to ntfy), and
onboard access-app creates a new gate with its allow list built from the registry. A saved policy
template once re-admitted a removed address on a new gate — that is why templates are banned and
reconciliation exists. API note: PATCH returns 10405 for tokens; GET the policy, edit, PUT it whole.
Home screen¶
https://home.embeddedera.com = our own one-file page (~/embeddedera-home/index.html, deploy with
~/.local/bin/home-deploy, Pages project embeddedera-home, Access app "EmbeddedEra Home" also
gating the pages.dev previews). Tiles: ERP, SOPs, Password vault, NAS/file browser, Website — hand-edited. The NAS tile links to
http://files.lan (Filebrowser, LAN only) and the page carries copy-to-clipboard SMB paths
(smb://192.168.5.15/EmbeddedEra, \\192.168.5.15\EmbeddedEra, Storage-Snapshots read-only,
user angel) because browsers block smb:// links outright. Angel
rejected the Cloudflare App Launcher as the home screen on 2026-09-11 because the address bar
shows embeddedera.cloudflareaccess.com/#/Launcher (the launcher cannot live on our domain). The
launcher still exists at that address with the same tiles; it costs nothing.
Apps¶
| App | Domain | Backend | Notes |
|---|---|---|---|
| EmbeddedEra ERP | erp.embeddedera.com | tunnel plex → 127.0.0.1:8100 |
header SSO into InvenTree, see inventree |
| EmbeddedEra SOPs | sop.embeddedera.com | Pages embeddedera-sop |
+ a second app gating *.embeddedera-sop.pages.dev previews |
| EmbeddedEra Assistant | chat.embeddedera.com | tunnel → 127.0.0.1:8200 | same policy; the service then checks departments |
| EmbeddedEra Admin | admin.embeddedera.com | tunnel → 127.0.0.1:8200 (same service, /admin) |
owner addresses only at the gate, plus the Administration department in the service |
| EmbeddedEra Reports | reports.embeddedera.com | tunnel → 127.0.0.1:3000 (Grafana) | folders per department, see grafana |
| EmbeddedEra Sandbox ERP | sandbox.embeddedera.com | tunnel → 127.0.0.1:8300 | disposable copy; also sandbox.lan with password login as break-glass |
| EmbeddedEra Sandbox Assistant | chat-sandbox.embeddedera.com | tunnel → 172.18.0.1:8201 | production-touching actions refused by the service |
| App Launcher | embeddedera.cloudflareaccess.com | — | same policy |
Login page design (logo, colors, footer) and the org name are set with
PUT /accounts/{id}/access/organizations; token permission Access: Organizations, Identity
Providers, and Groups · Edit was added for it. Session 24 h. Instant redirect to Google
(auto_redirect_to_identity) was tried and rejected as disorienting — keep the branded page.
Guests (2026-09-12). Outside addresses can be invited to the sandbox only: onboard guest. One-time PIN is enabled on the two sandbox apps exclusively — every production gate still admits Google/@embeddedera.com alone. Invitations carry an expiry in people.yml; the hourly access-sync removes them when they lapse.