Christoph Emsenhuber
381365b8ed
- docs/cf-tunnel-mapping.md: Single Source of Truth zur #1033-Diagnose (bf-Tunnel = Round-Robin über 3 Connectors macmini/pve/NAS) - mcp/cloudflare/: README + .env.example (echtes .env via mcp/.gitignore ausgeschlossen) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
2.2 KiB
Markdown
39 lines
2.2 KiB
Markdown
# Cloudflare — scoped API-Token (Writes) + OAuth-IdP-Secrets
|
|
|
|
Cloudflare wird wie jeder andere Dienst im Repo über einen **scoped API-Token** geschrieben
|
|
(Konvention wie `mcp/portainer`, `mcp/omada`). Die `cloudflare`-OAuth-MCP in Claude Code ist
|
|
**read-only** (Consent bietet keinen Write-Scope) → nur zum Lesen.
|
|
|
|
Plan/Kontext: `~/.claude/plans/schei-e-wenn-ich-das-breezy-biscuit.md` · SSoT: `docs/cf-tunnel-mapping.md`.
|
|
|
|
## 1. API-Token anlegen
|
|
dash.cloudflare.com → **My Profile → API Tokens → Create Token → Create Custom Token**
|
|
- **Permissions:**
|
|
- Account · Cloudflare Tunnel · **Edit**
|
|
- Zone · DNS · **Edit**
|
|
- Account · Access: Apps and Policies · **Edit**
|
|
- Account · Access: Organizations, Identity Providers, and Groups · **Edit**
|
|
- **Account Resources:** Include → Christoph@emsenhuber.com's Account
|
|
- **Zone Resources:** Include → Specific zone → emsenhuber.net
|
|
- Create → Token kopieren → in `.env` als `CF_API_TOKEN`.
|
|
|
|
## 2. OAuth-Apps für Access-Login (Callback überall gleich)
|
|
**Callback-URL:** `https://emsenhuber.cloudflareaccess.com/cdn-cgi/access/callback`
|
|
|
|
- **GitHub** (reparieren — Secret fehlt): github.com → Settings → Developer settings → OAuth Apps
|
|
→ bestehende App (client_id `Ov23li2h96hAkGRPJXYV`) → **Generate a new client secret** →
|
|
Authorization callback URL = obige Callback-URL → Secret in `.env` (`GITHUB_CLIENT_SECRET`).
|
|
- **Google:** console.cloud.google.com → APIs & Services → Credentials → Create OAuth client ID →
|
|
Web application → Authorized redirect URI = Callback-URL → client_id/secret in `.env`.
|
|
- **Facebook:** developers.facebook.com → Create App → Facebook Login → Valid OAuth Redirect URI =
|
|
Callback-URL → App-ID/Secret in `.env`.
|
|
|
|
## 3. Geli
|
|
`GELI_EMAIL` (für Social-Login-Policy). `GELI_PUBLIC_IP` nur falls stabile öffentliche IPv4 (CGNAT → leer).
|
|
|
|
## 4. Ausführung
|
|
Writes laufen per `curl` gegen `api.cloudflare.com` mit `Authorization: Bearer $CF_API_TOKEN`
|
|
(`set -a; . mcp/cloudflare/.env; set +a`). Claude wendet die Change-Sets aus dem Plan an und
|
|
verifiziert jeden Schritt extern (HTTP-Status, kein 1033). Reihenfolge: Token-Verify → Track A
|
|
(Tunnel) → Track B (Access).
|