From 5bb0f2b74d3df3f2e2e807abd37fa73f297272b3 Mon Sep 17 00:00:00 2001 From: Roger Date: Fri, 11 Sep 2026 18:16:47 +0200 Subject: [PATCH] SPEC-055 implemented: Proxmox WebUI via Cloudflare Tunnel and Access. proxmox.itecnologys.com redirects to Access; Tailscale :8006 remains break-glass. Co-authored-by: Cursor --- Infra-Network/ACCESS-BIG1.md | 11 ++++++----- .../SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md | 8 ++++---- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/Infra-Network/ACCESS-BIG1.md b/Infra-Network/ACCESS-BIG1.md index bf268c4..eaf4e8e 100644 --- a/Infra-Network/ACCESS-BIG1.md +++ b/Infra-Network/ACCESS-BIG1.md @@ -61,15 +61,16 @@ Backup: `/root/.ssh/authorized_keys.bak.*` no big1. --- -## HTTPS Proxmox (WebUI) — privado como o pfSense +## HTTPS Proxmox (WebUI) | Canal | URL | |-------|-----| -| **Tailscale (canónico)** | **https://100.116.138.100:8006/** | -| IP público `:8006` | **Bloqueado** (iptables DROP; ~100k+ drops) | -| Cert | CN=`big1.itecnologys.com` | +| **Browser (mundo) + CF Access** | **https://proxmox.itecnologys.com/** — login `admin@itecnologys.com` | +| **Tailscale (break-glass)** | **https://100.116.138.100:8006/** | +| IP público `:8006` | **Bloqueado** (iptables DROP) | -De qualquer sítio: Tailscale ligado → abrir `https://100.116.138.100:8006/` no browser. +Tunnel: `cloudflared-pve-admin.service` · SPEC-055 +De qualquer sítio **sem** Tailscale: abrir `https://proxmox.itecnologys.com/` → OTP email Access. Persistência: `/etc/network/if-up.d/zzz-tailscale-admin-hardening` + `/etc/iptables/rules.v4` (ACCEPT `tailscale0`/`lo` → `4422,8006`; DROP resto). diff --git a/Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md b/Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md index b64453c..7590682 100644 --- a/Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md +++ b/Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md @@ -2,7 +2,7 @@ **Criado:** 2026-09-11 **Operador:** Roger -**Status:** 🚧 EM CURSO — Access app + policy OK; **falta permissão Tunnel Edit** (token `cfut_llIr…` cria Access/DNS, não cria túnel) +**Status:** ✅ IMPLEMENTADO 2026-09-11 — https://proxmox.itecnologys.com (CF Access + Tunnel) **Hostname:** `proxmox.itecnologys.com` **Access email:** `admin@itecnologys.com` **big1:** `cloudflared` **2026.9.1** já instalado @@ -20,9 +20,9 @@ | Access App `proxmox-big1-spec055` | ✅ id `a68244f9-b062-44a8-bb00-4b9d03eae8cc` | | Access Policy allow email | ✅ | | `cloudflared` no big1 | ✅ 2026.9.1 instalado | -| Túnel `big1-pve-admin` | ❌ API Authentication error (falta Account → Cloudflare Tunnel → **Edit**) | -| DNS CNAME túnel | ⏳ após criar túnel | -| Origin `127.0.0.1:8006` | ⏳ após connector | +| Túnel `big1-pve-admin` | ✅ `7e693c4a-9138-4b44-b7fe-68322b83226a` healthy | +| DNS CNAME túnel | ✅ `proxmox` → `*.cfargotunnel.com` proxied | +| Origin `https://127.0.0.1:8006` | ✅ cloudflared-pve-admin active | **Desbloqueio:** no token CF adicionar **Account - Cloudflare Tunnel - Edit**, *ou* criar o túnel no dashboard Zero Trust e colar o **install token** (`eyJhIjoi…`).