ligbox/obsidian-vault
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SPEC-055: Access app ready; document Tunnel Edit permission gap.

Browse source 
Token can manage Access/DNS for proxmox.itecnologys.com but cannot create tunnels.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Roger 2026-09-11 18:11:44 +02:00
parent 81f8298a43
commit 0bfd7f5e1a
1 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md
View file

@ -2,13 +2,30 @@
**Criado:** 2026-09-11 **Criado:** 2026-09-11
**Operador:** Roger **Operador:** Roger
**Status:** 🚧 EM CURSO — hostname+email OK; **bloqueado em permissões API** (tokens locais só DNS / Global Key inválida) **Status:** 🚧 EM CURSO — Access app + policy OK; **falta permissão Tunnel Edit** (token `cfut_llIr…` cria Access/DNS, não cria túnel)
**Hostname:** `proxmox.itecnologys.com` **Hostname:** `proxmox.itecnologys.com`
**Access email:** `admin@itecnologys.com` **Access email:** `admin@itecnologys.com`
**big1:** `cloudflared` **2026.9.1** já instalado **big1:** `cloudflared` **2026.9.1** já instalado
--- ---
## Progresso implementação (2026-09-11)
| Item | Estado |
|------|--------|
| Hostname `proxmox.itecnologys.com` | ✅ escolhido |
| Email Access `admin@itecnologys.com` | ✅ |
| Token `cfut_llIr…` | ✅ Access + DNS; ❌ Tunnel Create |
| Access App `proxmox-big1-spec055` | ✅ id `a68244f9-b062-44a8-bb00-4b9d03eae8cc` |
| Access Policy allow email | ✅ |
| `cloudflared` no big1 | ✅ 2026.9.1 instalado |
| Túnel `big1-pve-admin` | ❌ API Authentication error (falta Account → Cloudflare Tunnel → **Edit**) |
| DNS CNAME túnel | ⏳ após criar túnel |
| Origin `127.0.0.1:8006` | ⏳ após connector |
**Desbloqueio:** no token CF adicionar **Account - Cloudflare Tunnel - Edit**, *ou* criar o túnel no dashboard Zero Trust e colar o **install token** (`eyJhIjoi…`).
## Objectivo ## Objectivo
Permitir abrir a WebUI do Proxmox **de qualquer sítio só com browser**, **sem** abrir `:8006` na WAN e **sem** exigir Tailscale nesse device — com **Cloudflare Access** à frente (Zero Trust). Permitir abrir a WebUI do Proxmox **de qualquer sítio só com browser**, **sem** abrir `:8006` na WAN e **sem** exigir Tailscale nesse device — com **Cloudflare Access** à frente (Zero Trust).