Skip to main content

Cloudflare: verified facts for the personal workbench

Verified facts about the Cloudflare account that hosts Justin's personal workbench site. Procedures live in Runbooks and link back here; this page is the facts layer. Verified 2026-10-02 against the live API and external HTTP checks.

The workbench deployment​

  • Pages project name: dashboard, in Justin's personal Cloudflare account.
  • Cloudflare assigned the production subdomain dashboard-71j.pages.dev. The project name does not guarantee the plain subdomain; when dashboard.pages.dev was already taken, Cloudflare appended a suffix. Always read the project's actual subdomain field instead of assuming it.
  • Live site: /
  • Source of truth: the private GitHub repo jknash/dashboard; the deployed tree is its site/ folder, uploaded through the API (direct upload), not built by Cloudflare.
  • Direct-upload file hashing (verified against wrangler's published test vectors): blake3(base64(content) + extension_without_dot), hex digest, first 32 characters.
  • Every deployment also gets a per-deployment preview host of the form https://<deployment-prefix>.dashboard-71j.pages.dev/. A new deployment mints a new preview host.

Access behavior on pages.dev hosts​

  • An Access application binds to one host plus path pattern. Applications created for the production host do not cover preview hosts; those are different hostnames and serve the same content publicly unless protected separately.
  • A wildcard application domain such as *.dashboard-71j.pages.dev/finance/* covers every preview host for that section. The workbench runs both sets: four production applications and four wildcard preview applications, for the finance, divorce, inbox, and docs sections.
  • The /* path pattern covers the section's data files as well as its pages, for example /finance/data/finance.json. Verified: unauthenticated requests to pages and data files alike return a 302 to the team login.
  • The landing page at the root is intentionally public.
  • Access team domain for this account: floral-pine-c9f7.cloudflareaccess.com.

Identity: the email a login method presents is what the policy must allow​

  • The only login method currently enabled on the organization is the Cloudflare identity provider (sign in with a Cloudflare account). The one-time PIN (email code) provider is not enabled.
  • Signing in with the Cloudflare provider presents the Cloudflare account's email address, which for Justin is jknash@x-centric.com, not his Gmail.
  • Every workbench policy therefore allows both of the owner's addresses: jknash@gmail.com and jknash@x-centric.com. If the presented email is not in an application's allow policy, Access answers "That account does not have access" even though the sign-in itself succeeded.

Automation token permission boundaries (verified 2026-10-02)​

The automation token (named workbench-automation, stored in Muse's secure storage as custom.cloudflare; never copy its value into a document, repo, or chat) carries Pages: Edit and Access: Apps and Policies: Edit. Verified boundaries:

  • Allowed: create and edit Pages projects, upload deployments, list, create, and edit Access applications and their policies.
  • Denied: reading or creating the Access organization (error 10000), creating identity providers (error 1010), and reading the Access request log (error 10000). Those need the separate "Access: Organizations, Identity Providers, and Groups" permission, or a human working in the Zero Trust dashboard.
  • If Access has never been enabled on the account, application creation fails with error 9999 ("Access is not enabled"). Only the account owner can enable it, in the dashboard under Zero Trust.

Privacy rules for this site​

  • The repo stays private. No API keys, tokens, bank exports, full account numbers, or credentials in the repo or the deployed tree; data files are sanitized snapshots only.
  • A protected section is not protected until an outside, unauthenticated request proves it (302 to the Access login, not page content), on the production host and a preview host.

Published by Muse · 2026-10-02.