Repository navigation
design(pm-stack): one public URL for the dashboard behind Cloudflare Access (settled access model, not yet implemented) #1182
Description
Finding
Drew's settled rule (2026-10-25): the aggregator may be public ONLY behind a password/auth gate (e.g. Cloudflare Access); today it's loopback+tailnet only, so his "single URL" works only on-tailnet. Kaneo already proves the pattern (kaneo.security.cab via pm-tunnel + its own auth). The decision is made; the implementation for the aggregator was never filed.
Proposal
Design + (on Drew's go in this issue) implement: a hostname (e.g. pm.security.cab) via the existing pm-tunnel, Cloudflare Access in front (identity = Drew's Google SSO), aggregator itself unchanged (still binds loopback+tailnet; tunnel reaches loopback). Document the auth model + break-glass (tailnet path unaffected). This issue is the design/record - implementation waits for Drew's explicit go recorded here.
Acceptance
- Design recorded with hostname, Access policy, and failure modes; after Drew's go, the URL serves the dashboard post-Access-login and rejects unauthenticated requests (verified from off-tailnet).
Refs: Dashboard: add program status/roadmap page (/program) #1046-era access decision (2026-10-25).
Acceptance criteria
- A design is recorded (on this issue or in repo
doc/) naming the hostname, the Cloudflare Access policy (identity = Drew's Google SSO), and the failure modes. - Implementation does not start until Drew's explicit go is recorded on this issue — that gate is part of the acceptance, not a delay.
- After Drew's go: the URL serves the dashboard post-Access-login and rejects unauthenticated requests, verified from off-tailnet; the aggregator itself still binds loopback+tailnet only, and the tailnet break-glass path is unaffected and documented.
Activity
developing-today commentedon Oct 27, 2026
CODE-318
dezren39 commentedon Oct 28, 2026
Intake review
Related: epic #1184 (parent — this is its "one public URL" child) · #1253 (SSO propagation design, which starts from the Access identity settled here) · #1254 (PWA/push — its delivery path depends on behind-Access vs tailnet-only) · Kaneo's
kaneo.security.cabvia pm-tunnel as the working pattern proof.Notes: Still live — verified this run: no merged PR puts the aggregator behind Access; merged-PR searches return only unrelated number coincidences. The access decision itself is settled (Drew, 2026-10-25, per the body); what is missing is the recorded design and Drew's go. The issue arrived with a
## Acceptancesection; the appended## Acceptance criteriaformalizes it, gate included.effort/mfor design + implementation once approved.Risks / suggested approach: this is the one item in this batch with a genuine Drew gate — the design can be written now, but implementation must wait for his recorded go; the monitor has NOT added
user/escalated, because the issue itself is the record he will answer on and the design step is unblocked.— repo-fleet-monitor intake pass, 2026-10-28T04:00Z
5 remaining items
dezren39 commentedon Nov 1, 2026
Claimed queue task 4976 as repo-worker-code. Revalidating the issue and the approved Cloudflare Access/tunnel plan before making any change.
dezren39 commentedon Nov 1, 2026
Queue task 4976 is blocked as
packet_defect: the packet cites comment 6552478930 as Drew's GO, but that comment is the earlier escalation asking for a go/no-go, and the visible issue-comment history contains no explicit GO. No Cloudflare configuration was changed. Resume only with corrected approval evidence or a new explicit GO.developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 2468 (triage, blocked, priority 50) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03