CF/#1033 📄 CF-Tunnel-Mapping (SSoT) + cloudflare-MCP-Scaffold

- docs/cf-tunnel-mapping.md: Single Source of Truth zur #1033-Diagnose
  (bf-Tunnel = Round-Robin über 3 Connectors macmini/pve/NAS)
- mcp/cloudflare/: README + .env.example (echtes .env via mcp/.gitignore ausgeschlossen)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

mcp/cloudflare/.env.example

@@ -0,0 +1,22 @@
+# Cloudflare scoped API-Token — Vorlage. Echte Werte → .env (gitignored via mcp/**/.env)
+# Token-Scopes (least-privilege): Cloudflare Tunnel:Edit, DNS:Edit (Zone emsenhuber.net),
+# Access: Apps and Policies:Edit, Access: Organizations, Identity Providers, and Groups:Edit
+CF_API_TOKEN=
+
+# Feste IDs (kein Secret, hier als Referenz):
+CF_ACCOUNT_ID=393c051f3accf51881d6c98fc5b66c36
+CF_ZONE_ID=1b5bc02fdf61b6b989afde543f3f4134
+CF_BF_TUNNEL_ID=70d6a4cf-aa1d-4a91-b918-91fab4fa7270
+
+# --- OAuth-App-Secrets für Access-IdPs (von den jeweiligen Provider-Konsolen) ---
+# Callback-URL überall: https://emsenhuber.cloudflareaccess.com/cdn-cgi/access/callback
+GITHUB_CLIENT_ID=Ov23li2h96hAkGRPJXYV
+GITHUB_CLIENT_SECRET=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+FACEBOOK_APP_ID=
+FACEBOOK_APP_SECRET=
+
+# --- Geli ---
+GELI_EMAIL=
+GELI_PUBLIC_IP=     # optional, /32 — nur falls stabile öffentliche IPv4 (bei CGNAT leer lassen)

mcp/cloudflare/README.md

@@ -0,0 +1,38 @@
+# Cloudflare — scoped API-Token (Writes) + OAuth-IdP-Secrets
+
+Cloudflare wird wie jeder andere Dienst im Repo über einen **scoped API-Token** geschrieben
+(Konvention wie `mcp/portainer`, `mcp/omada`). Die `cloudflare`-OAuth-MCP in Claude Code ist
+**read-only** (Consent bietet keinen Write-Scope) → nur zum Lesen.
+
+Plan/Kontext: `~/.claude/plans/schei-e-wenn-ich-das-breezy-biscuit.md` · SSoT: `docs/cf-tunnel-mapping.md`.
+
+## 1. API-Token anlegen
+dash.cloudflare.com → **My Profile → API Tokens → Create Token → Create Custom Token**
+- **Permissions:**
+  - Account · Cloudflare Tunnel · **Edit**
+  - Zone · DNS · **Edit**
+  - Account · Access: Apps and Policies · **Edit**
+  - Account · Access: Organizations, Identity Providers, and Groups · **Edit**
+- **Account Resources:** Include → Christoph@emsenhuber.com's Account
+- **Zone Resources:** Include → Specific zone → emsenhuber.net
+- Create → Token kopieren → in `.env` als `CF_API_TOKEN`.
+
+## 2. OAuth-Apps für Access-Login (Callback überall gleich)
+**Callback-URL:** `https://emsenhuber.cloudflareaccess.com/cdn-cgi/access/callback`
+
+- **GitHub** (reparieren — Secret fehlt): github.com → Settings → Developer settings → OAuth Apps
+  → bestehende App (client_id `Ov23li2h96hAkGRPJXYV`) → **Generate a new client secret** →
+  Authorization callback URL = obige Callback-URL → Secret in `.env` (`GITHUB_CLIENT_SECRET`).
+- **Google:** console.cloud.google.com → APIs & Services → Credentials → Create OAuth client ID →
+  Web application → Authorized redirect URI = Callback-URL → client_id/secret in `.env`.
+- **Facebook:** developers.facebook.com → Create App → Facebook Login → Valid OAuth Redirect URI =
+  Callback-URL → App-ID/Secret in `.env`.
+
+## 3. Geli
+`GELI_EMAIL` (für Social-Login-Policy). `GELI_PUBLIC_IP` nur falls stabile öffentliche IPv4 (CGNAT → leer).
+
+## 4. Ausführung
+Writes laufen per `curl` gegen `api.cloudflare.com` mit `Authorization: Bearer $CF_API_TOKEN`
+(`set -a; . mcp/cloudflare/.env; set +a`). Claude wendet die Change-Sets aus dem Plan an und
+verifiziert jeden Schritt extern (HTTP-Status, kein 1033). Reihenfolge: Token-Verify → Track A
+(Tunnel) → Track B (Access).