From 0bfd7f5e1a5a3636d7da32bbfa32423b192aad6c Mon Sep 17 00:00:00 2001 From: Roger Date: Fri, 11 Sep 2026 18:11:44 +0200 Subject: [PATCH] SPEC-055: Access app ready; document Tunnel Edit permission gap. Token can manage Access/DNS for proxmox.itecnologys.com but cannot create tunnels. Co-authored-by: Cursor --- .../SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md b/Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md index 9283975..b64453c 100644 --- a/Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md +++ b/Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md @@ -2,13 +2,30 @@ **Criado:** 2026-09-11 **Operador:** Roger -**Status:** 🚧 EM CURSO — hostname+email OK; **bloqueado em permissĂ”es API** (tokens locais sĂł DNS / Global Key invĂĄlida) +**Status:** 🚧 EM CURSO — Access app + policy OK; **falta permissĂŁo Tunnel Edit** (token `cfut_llIr
` cria Access/DNS, nĂŁo cria tĂșnel) **Hostname:** `proxmox.itecnologys.com` **Access email:** `admin@itecnologys.com` **big1:** `cloudflared` **2026.9.1** jĂĄ instalado --- + +## Progresso implementação (2026-09-11) + +| Item | Estado | +|------|--------| +| Hostname `proxmox.itecnologys.com` | ✅ escolhido | +| Email Access `admin@itecnologys.com` | ✅ | +| Token `cfut_llIr
` | ✅ Access + DNS; ❌ Tunnel Create | +| Access App `proxmox-big1-spec055` | ✅ id `a68244f9-b062-44a8-bb00-4b9d03eae8cc` | +| Access Policy allow email | ✅ | +| `cloudflared` no big1 | ✅ 2026.9.1 instalado | +| TĂșnel `big1-pve-admin` | ❌ API Authentication error (falta Account → Cloudflare Tunnel → **Edit**) | +| DNS CNAME tĂșnel | ⏳ apĂłs criar tĂșnel | +| Origin `127.0.0.1:8006` | ⏳ apĂłs connector | + +**Desbloqueio:** no token CF adicionar **Account - Cloudflare Tunnel - Edit**, *ou* criar o tĂșnel no dashboard Zero Trust e colar o **install token** (`eyJhIjoi
`). + ## Objectivo Permitir abrir a WebUI do Proxmox **de qualquer sĂ­tio sĂł com browser**, **sem** abrir `:8006` na WAN e **sem** exigir Tailscale nesse device — com **Cloudflare Access** Ă  frente (Zero Trust).