From d4d950f4a18b970020137064fccf62831a3de8e7 Mon Sep 17 00:00:00 2001 From: xnoto Date: Tue, 25 Aug 2026 18:16:08 -0600 Subject: [PATCH] feat(cloudflare): protect opencode hostname --- README.md | 1 + cf-access-opencode.tf | 26 ++++++++++++++++++++++++++ cf-tunnels.tf | 1 + 3 files changed, 28 insertions(+) create mode 100644 cf-access-opencode.tf diff --git a/README.md b/README.md index 3959aba..c79f45c 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,7 @@ No modules. | [cloudflare_zero_trust_access_application.alertmanager](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource | | [cloudflare_zero_trust_access_application.grafana_alerts](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource | | [cloudflare_zero_trust_access_application.k3s](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource | +| [cloudflare_zero_trust_access_application.opencode](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource | | [cloudflare_zero_trust_access_application.warp](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource | | [cloudflare_zero_trust_access_group.admins](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_group) | resource | | [cloudflare_zero_trust_access_identity_provider.github](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) | resource | diff --git a/cf-access-opencode.tf b/cf-access-opencode.tf new file mode 100644 index 0000000..12bd1d7 --- /dev/null +++ b/cf-access-opencode.tf @@ -0,0 +1,26 @@ +# OpenCode can execute commands against its mounted workspace. Require the +# existing GitHub-backed admins group before traffic reaches the origin. +resource "cloudflare_zero_trust_access_application" "opencode" { + account_id = local.account_id + name = "OpenCode" + type = "self_hosted" + domain = "opencode.makeitwork.cloud" + session_duration = "24h" + + allowed_idps = [ + cloudflare_zero_trust_access_identity_provider.github.id, + ] + + policies = [ + { + name = "makeitworkcloud-admins" + decision = "allow" + session_duration = "24h" + include = [{ + group = { + id = cloudflare_zero_trust_access_group.admins.id + } + }] + } + ] +} diff --git a/cf-tunnels.tf b/cf-tunnels.tf index cf9903d..239ce85 100644 --- a/cf-tunnels.tf +++ b/cf-tunnels.tf @@ -22,6 +22,7 @@ locals { "forgejo", "grafana", "k3s", + "opencode", "status", "alertmanager", ]