ligbox/obsidian-vault
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SPEC-055 implemented: Proxmox WebUI via Cloudflare Tunnel and Access.

Browse source 
proxmox.itecnologys.com redirects to Access; Tailscale :8006 remains break-glass.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Roger 2026-09-11 18:16:47 +02:00
parent 0bfd7f5e1a
commit 5bb0f2b74d
2 changed files with 10 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
Infra-Network/ACCESS-BIG1.md
View file

@ -61,15 +61,16 @@ Backup: `/root/.ssh/authorized_keys.bak.*` no big1.
--- ---
## HTTPS Proxmox (WebUI) — privado como o pfSense ## HTTPS Proxmox (WebUI)
| Canal | URL | | Canal | URL |
|-------|-----| |-------|-----|
| **Tailscale (canónico)** | **https://100.116.138.100:8006/** | | **Browser (mundo) + CF Access** | **https://proxmox.itecnologys.com/** — login `admin@itecnologys.com` |
| IP público `:8006` | **Bloqueado** (iptables DROP; ~100k+ drops) | | **Tailscale (break-glass)** | **https://100.116.138.100:8006/** |
| Cert | CN=`big1.itecnologys.com` | | IP público `:8006` | **Bloqueado** (iptables DROP) |
De qualquer sítio: Tailscale ligado → abrir `https://100.116.138.100:8006/` no browser. Tunnel: `cloudflared-pve-admin.service` · SPEC-055
De qualquer sítio **sem** Tailscale: abrir `https://proxmox.itecnologys.com/` → OTP email Access.
Persistência: `/etc/network/if-up.d/zzz-tailscale-admin-hardening` + `/etc/iptables/rules.v4` Persistência: `/etc/network/if-up.d/zzz-tailscale-admin-hardening` + `/etc/iptables/rules.v4`
(ACCEPT `tailscale0`/`lo` → `4422,8006`; DROP resto). (ACCEPT `tailscale0`/`lo` → `4422,8006`; DROP resto).

8
Infra-Network/SPEC-055-PROXMOX-CF-TUNNEL-ACCESS-PLAN.md
View file

@ -2,7 +2,7 @@
**Criado:** 2026-09-11 **Criado:** 2026-09-11
**Operador:** Roger **Operador:** Roger
**Status:** 🚧 EM CURSO — Access app + policy OK; **falta permissão Tunnel Edit** (token `cfut_llIr…` cria Access/DNS, não cria túnel) **Status:** ✅ IMPLEMENTADO 2026-09-11 — https://proxmox.itecnologys.com (CF Access + Tunnel)
**Hostname:** `proxmox.itecnologys.com` **Hostname:** `proxmox.itecnologys.com`
**Access email:** `admin@itecnologys.com` **Access email:** `admin@itecnologys.com`
**big1:** `cloudflared` **2026.9.1** já instalado **big1:** `cloudflared` **2026.9.1** já instalado
@ -20,9 +20,9 @@
| Access App `proxmox-big1-spec055` | ✅ id `a68244f9-b062-44a8-bb00-4b9d03eae8cc` | | Access App `proxmox-big1-spec055` | ✅ id `a68244f9-b062-44a8-bb00-4b9d03eae8cc` |
| Access Policy allow email | ✅ | | Access Policy allow email | ✅ |
| `cloudflared` no big1 | ✅ 2026.9.1 instalado | | `cloudflared` no big1 | ✅ 2026.9.1 instalado |
| Túnel `big1-pve-admin` | ❌ API Authentication error (falta Account → Cloudflare Tunnel → **Edit**) | | Túnel `big1-pve-admin` | ✅ `7e693c4a-9138-4b44-b7fe-68322b83226a` healthy |
| DNS CNAME túnel | ⏳ após criar túnel | | DNS CNAME túnel | ✅ `proxmox` → `*.cfargotunnel.com` proxied |
| Origin `127.0.0.1:8006` | ⏳ após connector | | Origin `https://127.0.0.1:8006` | ✅ cloudflared-pve-admin active |
**Desbloqueio:** no token CF adicionar **Account - Cloudflare Tunnel - Edit**, *ou* criar o túnel no dashboard Zero Trust e colar o **install token** (`eyJhIjoi…`). **Desbloqueio:** no token CF adicionar **Account - Cloudflare Tunnel - Edit**, *ou* criar o túnel no dashboard Zero Trust e colar o **install token** (`eyJhIjoi…`).