Technical Architecture: Cloudflare Edge & Access Integration¶

DNS Infrastructure & Domain Delegation¶

Registrar: Domain registration for WorkWingman is hosted at Porkbun.
DNS Management: Nameservers are delegated to Cloudflare (TODO(verify) exact zone and plan details).

Cloudflare acts as the DNS authority and proxy gateway for application traffic.
Critical Requirement: A set of legacy A records (count TODO(verify) — recorded as 11) must NEVER be proxied (must remain grey-clouded / unproxied). Enabling Cloudflare proxying (orange-clouding) on these 11 records breaks legacy application functionality.
TODO(verify) exact list of the 11 legacy A record names and IP mappings.

Layer 1 (Perimeter Security): Cloudflare Access protects admin surfaces and documentation routes. Primary authentication uses One-Time Passcode (OTP) sent via email.
Layer 2 (Application Security): Application-level OAuth and session authorization operate behind Cloudflare Access. Reader tiers and docs authentication sit behind Access.

HTTP PATCH Unsupported: Executing a PATCH request on an Access application object results in HTTP error 10405 (Method Not Allowed). API updates must send a complete PUT payload containing the entire application state.
IdP Pinning Side-Effect: Pinning the allowed_idps array on an Access application removes OTP as a login option. OTP must remain unpinned/enabled to preserve OTP login workflows.

Board standby replicas route traffic through Cloudflare Tunnels using cloudflared.
The architecture uses multiple cloudflared connectors on a single tunnel for redundancy (recorded as 3/1 — TODO(verify)) (TODO(verify) tunnel IDs and connector hostnames).
Failover Status: Validation of automatic failover is currently blocked because Cloudflare Access returns an HTTP 302 redirect during check probes. Failover behavior is still being proven.

Angular Critical CSS: Enforcing strict CSP broke Angular's built-in inlineCritical CSS extraction during packaged builds. Resolved by explicitly setting inlineCritical: false in angular build configuration.
Admin HTMX: Strict CSP silently blocked unpkg-hosted htmx on /Admin. Self-hosting htmx was rejected because it would have implicitly enabled hx-boost across admin forms; the admin surface opted out of boosting instead.