Access Control / Access Architecture

Cloudflare Tunnel to Server

Internal architecture record for Cloudflare Tunnel routes, localhost service mappings, protected browser URLs, Cloudflare Access authentication methods, and administrator access paths for the internal command center and public development site.

Text size
Status: publishedCreated: 06/28/2026Last updated: 06/28/2026

Document Scope

The service uses Cloudflare Tunnel and Cloudflare Access to provide authenticated browser access to selected local development and internal command-center services.

This document defines the active access architecture for the current Cloudflare Tunnel implementation. It records the tunnel name, local service addresses, browser-access URLs, Cloudflare Access application, active login methods, current administrator access path, traffic flow, local-access behavior, user-access model, and maintenance values that must stay current.

This document is written for human operators, employees, contractors, developers, AI agents, automation workers, and future MCP/RAG tooling that need to understand how to reach the correct service, how traffic reaches the local server, and how access is controlled.

1. System Overview

The access architecture uses three connected layers.

  1. The first layer is the local server environment. The public development site and the internal command center run locally on the server machine through loopback addresses.

  2. The second layer is Cloudflare Tunnel. The tunnel connector runs on the server machine and connects Cloudflare to the local services.

  3. The third layer is Cloudflare Access. Cloudflare Access evaluates the user login before allowing browser traffic to reach the tunnel route.

The working result is that selected local services can be reached through HTTPS browser URLs while remaining mapped to local services running on the server machine.

2. Active Architecture

The Cloudflare Tunnel is named:

JH Mission Control

The Cloudflare Access application is named:

JH Mission Control

The approved domain for this access architecture is:

darkhorsekarma.net

The active public website development hostname is:

jh-site.darkhorsekarma.net

The active private internal administrative command center, Mission Control, hostname is:

jh-admin.darkhorsekarma.net

The Windows tunnel connector runs through the cloudflared service on the server machine that hosts the local services.

3. Address and Route Inventory

The public website development site has two access addresses.

Server-local address:

http://127.0.0.1:43000

Cloudflare Tunnel browser URL:

https://jh-site.darkhorsekarma.net/

The private internal command center, Mission Control, has two access addresses.

Server-local address:

http://127.0.0.1:42000

Cloudflare Tunnel browser URL:

https://jh-admin.darkhorsekarma.net/

The public website development site source path is:

C:\dev\site\public

The private internal command center, Mission Control, source path is:

C:\dev\admin

The current production public website is hosted separately at:

https://justheadlines.pages.dev/

The production public website is the customer-facing deployment. The jh-site.darkhorsekarma.net route is the authenticated tunnel route to the local development copy.

4. Traffic Flow

A browser request to the public website development tunnel route follows this path:

Browser
→ https://jh-site.darkhorsekarma.net/
→ Cloudflare DNS and edge
→ Cloudflare Access
→ Cloudflare Tunnel
→ cloudflared connector on the server machine
→ http://127.0.0.1:43000
→ public development site

A browser request to the private internal command center, Mission Control, follows this tunnel route:

Browser
→ https://jh-admin.darkhorsekarma.net/
→ Cloudflare DNS and edge
→ Cloudflare Access
→ Cloudflare Tunnel
→ cloudflared connector on the server machine
→ http://127.0.0.1:42000
→ internal command center

Cloudflare handles the public HTTPS browser connection. The local services are reached by the tunnel connector at their local HTTP addresses.

5. Authentication and Access Control

The active Cloudflare Access application protects these hostnames:

jh-site.darkhorsekarma.net
jh-admin.darkhorsekarma.net

The current Cloudflare Access policy is named:

Owner Access

The policy action is:

Allow

The policy selector is:

Emails

The current approved email is:

[REDACTED]

The active login methods are:

One-time PIN
GitHub Account [REDACTED] OpenID Connector (OICD)

One-time PIN lets an approved user enter an allowed email address and receive a six-digit code from Cloudflare.

GitHub OICD to Mission Control lets the administrator authenticate through the configured GitHub account using the login methods available on that GitHub account, including passkey, username and password, and multi-factor authentication.

Cloudflare Access grants browser access when the authenticated identity satisfies the Access policy.

6. Current Administrator Access

The current administrator access identity is:

[REDACTED]

The administrator can reach the protected tunnel URLs through the email one-time PIN login method.

The administrator can also reach the protected tunnel URLs through the configured GitHub OAuth provider.

Both login methods resolve into the same Cloudflare Access policy check for the protected application.

7. Local Server Access

Local server access uses the 127.0.0.1 addresses directly on the server machine.

Public development site local address:

http://127.0.0.1:43000

Internal command center local address:

http://127.0.0.1:42000

This path is the direct local application path. It is controlled by the local machine, the local application, and the local server process.

Use the local addresses for server-side service checks, scheduled-task validation, local development testing, and confirming that the underlying service is running.

Use the Cloudflare Tunnel URLs for browser access from other devices, remote locations, incognito browser sessions, contractors, employees, AI agents, or workflows that need authenticated access through Cloudflare.

8. Approved User Access

Additional users receive access through Cloudflare Access policy membership.

The access-granting process uses these values:

User identifier: the email address the person will use for access.

Access application: JH Mission Control.

Access policy: Owner Access or the applicable future role-specific policy.

Login method: One-time PIN unless a different approved identity provider is assigned.

The user access flow is:

  1. The user opens the approved tunnel URL.
  2. Cloudflare presents the enabled login methods.
  3. The user enters the email address approved in the Access policy.
  4. Cloudflare sends a one-time code to that email address.
  5. The user enters the code.
  6. Cloudflare checks the Access policy.
  7. Cloudflare routes the browser request to the tunnel endpoint.

This gives the approved person browser access to the protected tunnel endpoint.

9. Operating Use

Use https://jh-site.darkhorsekarma.net/ when a user, developer, contractor, AI agent, or browser-based workflow needs access to the local development copy of the public website.

Use https://jh-admin.darkhorsekarma.net/ when a user, developer, contractor, AI agent, or browser-based workflow needs access to the internal command center.

Use http://127.0.0.1:43000 when working directly on the server machine and checking the public development site service.

Use http://127.0.0.1:42000 when working directly on the server machine and checking the internal command-center service.

Use https://justheadlines.pages.dev/ when checking the current production public website.

10. Maintenance Requirements

Update this document when any of these values change:

  1. Cloudflare Tunnel name.
  2. Cloudflare Access application name.
  3. Cloudflare Access policy name.
  4. Approved domain.
  5. Tunnel hostname.
  6. Local service port.
  7. Local service path.
  8. Enabled login method.
  9. Approved administrator email.
  10. Public production website URL.
  11. Server operating system or connector host.
  12. Identity provider name.

Update dependent internal documentation when it references an address that changes.

Documents that describe local server work should include the relevant 127.0.0.1 address.

Documents that describe browser access should include the relevant Cloudflare Tunnel URL.

Documents that describe production customer access should use the production public website URL.

11. Troubleshooting Reference

Use the local service address first when checking whether the application is running on the server machine.

Public development local check:

http://127.0.0.1:43000

Internal command-center local check:

http://127.0.0.1:42000

Use the tunnel URL after the local service check confirms that the local service is responding.

Public development tunnel check:

https://jh-site.darkhorsekarma.net/

Internal command-center tunnel check:

https://jh-admin.darkhorsekarma.net/

When the local service responds and the tunnel URL fails before login, review the tunnel connector, hostname route, DNS route, and local service mapping.

When the tunnel URL reaches the login screen and access fails after login, review the Access application, Access policy, approved email value, and enabled identity provider.

When the login succeeds and the page fails after authentication, review the local service, local route handling, application logs, and browser console output.

12. Human Operator Reference

Give users the tunnel URL that matches the service they need.

Public development site:

https://jh-site.darkhorsekarma.net/

Internal command center:

https://jh-admin.darkhorsekarma.net/

For email one-time PIN access, add the user's email address to the applicable Cloudflare Access policy.

For administrator OAuth access, use the configured GitHub OAuth provider named:

[REDACTED]

Store Cloudflare tunnel tokens, GitHub OAuth client secrets, passwords, recovery codes, private keys, and MFA recovery material in the approved secret-management location.

Keep this document limited to architecture values, access routes, operating logic, and non-secret configuration names.

13. AI Agent Reference

AI agents should use this document as the first reference for the current Cloudflare Tunnel and Cloudflare Access architecture.

Use the route inventory to determine the correct address for a task.

Use the traffic-flow section to reason about whether a problem is local-server-side, tunnel-side, authentication-side, or application-side.

Use the authentication section to identify the active Access application, policy, login methods, and approved administrator identity.

Use the maintenance section to identify which documented values must be updated after access architecture changes.

Preserve the domain spelling darkhorsekarma.net in generated access-control instructions, route references, and documentation updates.

Request missing access information by naming the missing architecture layer. Examples of architecture layers are local service address, tunnel hostname, Access application, Access policy, identity provider, approved user identity, and local application route.

14. Validation Checklist

Use this checklist after access architecture changes.

  1. The Cloudflare Tunnel name is JH Mission Control.
  2. The cloudflared connector is running on the server machine.
  3. The public development local service loads at http://127.0.0.1:43000.
  4. The internal command-center local service loads at http://127.0.0.1:42000.
  5. The public development tunnel URL loads at https://jh-site.darkhorsekarma.net/.
  6. The internal command-center tunnel URL loads at https://jh-admin.darkhorsekarma.net/.
  7. The Cloudflare Access application name is JH Mission Control.
  8. The Access policy includes the intended approved email addresses.
  9. Email one-time PIN login works for approved email addresses.
  10. GitHub OAuth login works for the administrator when enabled.
  11. Internal documentation distinguishes server-local addresses, tunnel URLs, and the production public website URL.
  12. Sensitive values are stored in the approved secret-management location.