# SPEC-056 — pfSense WebGUI via Cloudflare Tunnel + Access

**Criado:** 2026-09-11  
**Operador:** Roger  
**Status:** ✅ IMPLEMENTADO  
**Relacionado:** SPEC-053 · SPEC-055 · `ACCESS-PFSENSE.md`

---

## Objectivo

Mesmo modelo do Proxmox (SPEC-055): browser no mundo → **Cloudflare Access** (OTP email) → Tunnel → pfSense WebGUI, **sem** abrir `:10443` na WAN.

---

## Decisão

| Item | Valor |
|------|--------|
| Hostname | `https://firewall.itecnologys.com/` |
| Access app | `pfsense-big1-spec056` |
| Allow | `admin@itecnologys.com` |
| Tunnel | `big1-pve-admin` (`7e693c4a-9138-4b44-b7fe-68322b83226a`) |
| Origin | `https://10.10.10.1:10443` (`noTLSVerify`) |
| DNS | CNAME proxied → `*.cfargotunnel.com` (substitui A → WAN) |
| Break-glass | Tailscale `https://100.116.138.100:18443/` |

---

## Validação (2026-09-11)

- `https://firewall.itecnologys.com/` → **302** Cloudflare Access
- Tunnel **healthy**
- Tailscale `:18443` e LAN `:10443` → **200**
- Proxmox hostname no mesmo túnel → intacto

---

## Fora de âmbito

- SSH pfSense continua só LAN + ProxyJump (SPEC-053)
- API pública via este hostname: **não** (Access bloqueia scripts Basic Auth) — usar LAN/Tailscale