fix(mcp): move backend endpoints to first-level mcp-<name> hostnames by xnoto · Pull Request #28 · makeitworkcloud/tfroot-cloudflare

xnoto · 2026-08-26T17:54:02Z

What

Cloudflare Universal SSL covers only *.makeitwork.cloud, so <name>.mcp.makeitwork.cloud cannot present a certificate — the edge refuses the TLS handshake (verified: ssl alert 40 vs working 2nd-level name).

cf-tunnels.tf: backend CNAMEs renamed <name>.mcp → mcp-<name> (locals restructured: mcp_backends + concat)
cf-access-mcp.tf: wildcard Access app replaced by one mcp_gateway_backend application per backend FQDN (for_each), same service-token + admins policies

Ordering

The kustomize-cluster TunnelBinding subjects for the old names were withdrawn first (commit 351efd8, per AGENTS.md remove-before-rename). After this applies, subjects return with the new FQDNs, then client configs land.

Cloudflare Universal SSL covers only *.makeitwork.cloud, so <name>.mcp.makeitwork.cloud cannot present a certificate and the edge refuses the TLS handshake. Rename to mcp-<name>.makeitwork.cloud and replace the wildcard Access app with one application per backend FQDN.

github-actions · 2026-08-26T17:54:54Z

OpenTofu Plan

OpenTofu will perform the following actions:

  # cloudflare_dns_record.cluster_apps["apify.mcp"] will be destroyed
  # (because key ["apify.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "5fc464455b71719f1744a203d66fd77f" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "apify.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_dns_record.cluster_apps["argocd-makeitwork.mcp"] will be destroyed
  # (because key ["argocd-makeitwork.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "6cae88c23e9ba16f80b23a9dabbf9df7" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "argocd-makeitwork.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_dns_record.cluster_apps["aws-docs.mcp"] will be destroyed
  # (because key ["aws-docs.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "9357410ceafcecde2590075f3cddcfde" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "aws-docs.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_dns_record.cluster_apps["context7.mcp"] will be destroyed
  # (because key ["context7.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "49a5bf34f05104f46351d9052a23e546" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "context7.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_dns_record.cluster_apps["github.mcp"] will be destroyed
  # (because key ["github.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "45e7085e5d07f1291116c8b50ee76767" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "github.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_dns_record.cluster_apps["grafana-makeitwork.mcp"] will be destroyed
  # (because key ["grafana-makeitwork.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "e6fbbdc075f6c524a564a57050c64c5a" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "grafana-makeitwork.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_dns_record.cluster_apps["kubernetes.mcp"] will be destroyed
  # (because key ["kubernetes.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "0ae170eac2f4ace746e5cf5dc9fae358" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "kubernetes.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_dns_record.cluster_apps["mcp-apify"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-apify"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["mcp-argocd-makeitwork"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-argocd-makeitwork"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["mcp-aws-docs"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-aws-docs"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["mcp-context7"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-context7"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["mcp-github"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-github"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["mcp-grafana-makeitwork"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-grafana-makeitwork"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["mcp-kubernetes"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-kubernetes"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["mcp-parallel-search"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-parallel-search"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["mcp-terraform-docs"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp-terraform-docs"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["parallel-search.mcp"] will be destroyed
  # (because key ["parallel-search.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "8c7c382629da01014b1a5465ec1df0f9" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "parallel-search.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_dns_record.cluster_apps["terraform-docs.mcp"] will be destroyed
  # (because key ["terraform-docs.mcp"] is not in for_each map)
  - resource "cloudflare_dns_record" "cluster_apps" {
      - content     = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com" -> null
      - created_on  = "2026-08-26T17:44:59Z" -> null
      - id          = "99e5bafd9c7d80c2756766fee5a3dc78" -> null
      - meta        = jsonencode({})
      - modified_on = "2026-08-26T17:44:59Z" -> null
      - name        = "terraform-docs.mcp.makeitwork.cloud" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - settings    = {
          - flatten_cname = false -> null
          - ipv4_only     = false -> null
          - ipv6_only     = false -> null
        } -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "CNAME" -> null
      - zone_id     = (sensitive value) -> null
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["apify"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-apify.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP apify"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["argocd-makeitwork"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-argocd-makeitwork.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP argocd-makeitwork"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["aws-docs"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-aws-docs.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP aws-docs"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["context7"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-context7.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP context7"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["github"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-github.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP github"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["grafana-makeitwork"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-grafana-makeitwork.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP grafana-makeitwork"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["kubernetes"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-kubernetes.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP kubernetes"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["parallel-search"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-parallel-search.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP parallel-search"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backend["terraform-docs"] will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway_backend" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp-terraform-docs.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP terraform-docs"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_application.mcp_gateway_backends will be destroyed
  # (because cloudflare_zero_trust_access_application.mcp_gateway_backends is not in configuration)
  - resource "cloudflare_zero_trust_access_application" "mcp_gateway_backends" {
      - account_id                 = (sensitive value) -> null
      - allowed_idps               = [
          - "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ] -> null
      - app_launcher_visible       = true -> null
      - aud                        = "60c3cbd6b884819c8f7ec604165a8ee6437d402f1472f03124fd62042313ce6d" -> null
      - destinations               = [
          - {
              - type = "public" -> null
              - uri  = "*.mcp.makeitwork.cloud" -> null
            },
        ] -> null
      - domain                     = "*.mcp.makeitwork.cloud" -> null
      - http_only_cookie_attribute = true -> null
      - id                         = "279d54f6-f6b5-4dd7-b20a-4af19e88439d" -> null
      - name                       = "MCP Gateway Backends" -> null
      - policies                   = [
          - {
              - decision   = "non_identity" -> null
              - include    = [
                  - {
                      - service_token = {
                          - token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495" -> null
                        } -> null
                    },
                ] -> null
              - name       = "mcp-gateway-clients" -> null
              - precedence = 1 -> null
            },
          - {
              - decision   = "allow" -> null
              - include    = [
                  - {
                      - group = {
                          - id = "e0d9e873-31d7-4536-9234-3dad8a99d84d" -> null
                        } -> null
                    },
                ] -> null
              - name       = "makeitworkcloud-admins" -> null
              - precedence = 2 -> null
            },
        ] -> null
      - self_hosted_domains        = [
          - "*.mcp.makeitwork.cloud",
        ] -> null
      - session_duration           = "24h" -> null
      - type                       = "self_hosted" -> null
    }

Plan: 18 to add, 0 to change, 10 to destroy.

xnoto requested a review from a team as a code owner August 26, 2026 17:54

xnoto merged commit 2f763dd into main Aug 26, 2026
4 checks passed

xnoto deleted the fix/mcp-backend-first-level-hostnames branch August 26, 2026 17:55

Navigation Menu

Uh oh!

fix(mcp): move backend endpoints to first-level mcp-<name> hostnames - #28

fix(mcp): move backend endpoints to first-level mcp-<name> hostnames#28
xnoto merged 1 commit into
mainfrom
fix/mcp-backend-first-level-hostnames

xnoto commented Aug 26, 2026

Uh oh!

github-actions Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

xnoto commented Aug 26, 2026

What

Ordering

Uh oh!

github-actions Bot commented Aug 26, 2026

OpenTofu Plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant