Roger
d75b4d9319
firewall.itecnologys.com uses Access OTP; Tailscale :18443 remains break-glass. Co-authored-by: Cursor <cursoragent@cursor.com>
42 lines
1.2 KiB
Markdown
42 lines
1.2 KiB
Markdown
# SPEC-056 — pfSense WebGUI via Cloudflare Tunnel + Access
|
|
|
|
**Criado:** 2026-09-11
|
|
**Operador:** Roger
|
|
**Status:** ✅ IMPLEMENTADO
|
|
**Relacionado:** SPEC-053 · SPEC-055 · `ACCESS-PFSENSE.md`
|
|
|
|
---
|
|
|
|
## Objectivo
|
|
|
|
Mesmo modelo do Proxmox (SPEC-055): browser no mundo → **Cloudflare Access** (OTP email) → Tunnel → pfSense WebGUI, **sem** abrir `:10443` na WAN.
|
|
|
|
---
|
|
|
|
## Decisão
|
|
|
|
| Item | Valor |
|
|
|------|--------|
|
|
| Hostname | `https://firewall.itecnologys.com/` |
|
|
| Access app | `pfsense-big1-spec056` |
|
|
| Allow | `admin@itecnologys.com` |
|
|
| Tunnel | `big1-pve-admin` (`7e693c4a-9138-4b44-b7fe-68322b83226a`) |
|
|
| Origin | `https://10.10.10.1:10443` (`noTLSVerify`) |
|
|
| DNS | CNAME proxied → `*.cfargotunnel.com` (substitui A → WAN) |
|
|
| Break-glass | Tailscale `https://100.116.138.100:18443/` |
|
|
|
|
---
|
|
|
|
## Validação (2026-09-11)
|
|
|
|
- `https://firewall.itecnologys.com/` → **302** Cloudflare Access
|
|
- Tunnel **healthy**
|
|
- Tailscale `:18443` e LAN `:10443` → **200**
|
|
- Proxmox hostname no mesmo túnel → intacto
|
|
|
|
---
|
|
|
|
## Fora de âmbito
|
|
|
|
- SSH pfSense continua só LAN + ProxyJump (SPEC-053)
|
|
- API pública via este hostname: **não** (Access bloqueia scripts Basic Auth) — usar LAN/Tailscale
|