108 lines
2.6 KiB
Markdown
108 lines
2.6 KiB
Markdown
|
# Configure Cloudflare Access Email Allowlist
|
||
|
|
|
||
|
|
## Overview
|
||
|
|
|
||
|
|
You can restrict access to your Proxmox UIs to specific email addresses using Cloudflare Access policies.
|
||
|
|
|
||
|
|
## Quick Setup
|
||
|
|
|
||
|
|
### Option 1: Interactive Script
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cd /home/intlc/projects/proxmox/scripts/cloudflare-tunnels
|
||
|
|
./scripts/configure-access-policies.sh
|
||
|
|
```
|
||
|
|
|
||
|
|
The script will prompt you to enter email addresses one by one.
|
||
|
|
|
||
|
|
### Option 2: Command Line
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cd /home/intlc/projects/proxmox/scripts/cloudflare-tunnels
|
||
|
|
./scripts/configure-access-policies.sh user1@example.com user2@example.com user3@example.com
|
||
|
|
```
|
||
|
|
|
||
|
|
### Option 3: Via Cloudflare Dashboard
|
||
|
|
|
||
|
|
1. Go to: **https://one.dash.cloudflare.com/**
|
||
|
|
2. Navigate: **Zero Trust** → **Access** → **Applications**
|
||
|
|
3. Click on each application:
|
||
|
|
- Proxmox ml110-01
|
||
|
|
- Proxmox r630-01
|
||
|
|
- Proxmox r630-02
|
||
|
|
4. Click **"Policies"** tab
|
||
|
|
5. Click **"Add a policy"** or edit existing
|
||
|
|
6. Set:
|
||
|
|
- **Policy name**: "Allow Team Access"
|
||
|
|
- **Action**: Allow
|
||
|
|
- **Include**: Email → Add each allowed email
|
||
|
|
- **Require**: Email (for email verification)
|
||
|
|
7. Save
|
||
|
|
|
||
|
|
## What Gets Configured
|
||
|
|
|
||
|
|
The script/configures policies that:
|
||
|
|
- ✅ **Allow** access (instead of block)
|
||
|
|
- ✅ **Include** specific email addresses
|
||
|
|
- ✅ **Require** email verification (MFA if enabled)
|
||
|
|
- ✅ Apply to all 3 Proxmox UIs
|
||
|
|
|
||
|
|
## Policy Structure
|
||
|
|
|
||
|
|
```json
|
||
|
|
{
|
||
|
|
"name": "Allow Team Access",
|
||
|
|
"decision": "allow",
|
||
|
|
"include": [
|
||
|
|
{"email": {"email": "user1@example.com"}},
|
||
|
|
{"email": {"email": "user2@example.com"}}
|
||
|
|
],
|
||
|
|
"require": [
|
||
|
|
{"email": {}}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
```
|
||
|
|
|
||
|
|
## Adding More Emails Later
|
||
|
|
|
||
|
|
### Via Script
|
||
|
|
```bash
|
||
|
|
./scripts/configure-access-policies.sh user1@example.com user2@example.com user3@example.com
|
||
|
|
```
|
||
|
|
|
||
|
|
### Via Dashboard
|
||
|
|
1. Go to Access → Applications → [App Name] → Policies
|
||
|
|
2. Edit the "Allow Team Access" policy
|
||
|
|
3. Add more emails to the Include section
|
||
|
|
4. Save
|
||
|
|
|
||
|
|
## Removing Access
|
||
|
|
|
||
|
|
### Via Dashboard
|
||
|
|
1. Go to Access → Applications → [App Name] → Policies
|
||
|
|
2. Edit the policy
|
||
|
|
3. Remove email from Include section
|
||
|
|
4. Save
|
||
|
|
|
||
|
|
## Advanced Options
|
||
|
|
|
||
|
|
You can also configure:
|
||
|
|
- **Groups**: Create email groups for easier management
|
||
|
|
- **Service tokens**: For programmatic access
|
||
|
|
- **Country restrictions**: Allow only specific countries
|
||
|
|
- **IP restrictions**: Allow only specific IP ranges
|
||
|
|
- **Device posture**: Require specific device checks
|
||
|
|
|
||
|
|
See `docs/CLOUDFLARE_ACCESS_SETUP.md` for more details.
|
||
|
|
|
||
|
|
## Verification
|
||
|
|
|
||
|
|
After configuring, test access:
|
||
|
|
1. Open https://ml110-01.d-bis.org in an incognito window
|
||
|
|
2. You should see Cloudflare Access login
|
||
|
|
3. Login with an allowed email
|
||
|
|
4. You should be granted access
|
||
|
|
|
||
|
|
If you use a non-allowed email, access will be denied.
|
||
|
|
|