Cloudflare Edge Overview (Non-Technical)

What Cloudflare Does for WorkWingman

Cloudflare acts as the outer front door and security shield for WorkWingman. It manages domain routing, shields internal tools from public access, and ensures web traffic reaches the correct destinations safely.

Domain & DNS Setup

WorkWingman registers its website name through Porkbun, while Cloudflare manages the DNS direction system. TODO(verify) exact domain and plan details.

Two-Layer Security Model

• Layer 1 (Cloudflare Access): Before reaching documentation or admin areas, users must verify their identity using a One-Time Passcode (OTP) emailed to them by Cloudflare.
• Layer 2 (App Auth): After passing Cloudflare's check, users authenticate with WorkWingman's own sign-in system (OAuth). Reader access and docs permissions operate behind this double layer.

Preserving Legacy Services

WorkWingman maintains 11 legacy server address records (A records). These records (recorded as 11 — TODO(verify) count) are specifically set to bypass Cloudflare proxying, because running them through Cloudflare breaks their underlying legacy connections. TODO(verify) list of 11 legacy services.

Secure Server Connections (WING-225)

To connect standby board systems safely, WorkWingman uses secure tunnels (via cloudflared). Three connector software instances connect to a single tunnel to prevent single points of failure. Testing for automatic failover switching is currently ongoing.

Page Display & Security Adjustments

Strict web security policies required small adjustments: - Page styling settings were tweaked so security rules don't block page layouts. - Admin forms opted out of automatic page-boosting scripts to prevent unintended form behaviors.