proxmox/scripts/cloudflare-tunnels/CONFIGURE_ACCESS_EMAILS.md

Configure Cloudflare Access Email Allowlist

Overview

You can restrict access to your Proxmox UIs to specific email addresses using Cloudflare Access policies.

Quick Setup

Option 1: Interactive Script

cd /home/intlc/projects/proxmox/scripts/cloudflare-tunnels
./scripts/configure-access-policies.sh

The script will prompt you to enter email addresses one by one.

Option 2: Command Line

cd /home/intlc/projects/proxmox/scripts/cloudflare-tunnels
./scripts/configure-access-policies.sh user1@example.com user2@example.com user3@example.com

Option 3: Via Cloudflare Dashboard

1. Go to: https://one.dash.cloudflare.com/
2. Navigate: Zero Trust → Access → Applications
3. Click on each application:
   • Proxmox ml110-01
   • Proxmox r630-01
   • Proxmox r630-02
4. Click "Policies" tab
5. Click "Add a policy" or edit existing
6. Set:
   • Policy name: "Allow Team Access"
   • Action: Allow
   • Include: Email → Add each allowed email
   • Require: Email (for email verification)
7. Save

What Gets Configured

The script/configures policies that:

• ✅ Allow access (instead of block)
• ✅ Include specific email addresses
• ✅ Require email verification (MFA if enabled)
• ✅ Apply to all 3 Proxmox UIs

Policy Structure

{
  "name": "Allow Team Access",
  "decision": "allow",
  "include": [
    {"email": {"email": "user1@example.com"}},
    {"email": {"email": "user2@example.com"}}
  ],
  "require": [
    {"email": {}}
  ]
}

Adding More Emails Later

Via Script

./scripts/configure-access-policies.sh user1@example.com user2@example.com user3@example.com

Via Dashboard

1. Go to Access → Applications → [App Name] → Policies
2. Edit the "Allow Team Access" policy
3. Add more emails to the Include section
4. Save

Removing Access

Via Dashboard

1. Go to Access → Applications → [App Name] → Policies
2. Edit the policy
3. Remove email from Include section
4. Save

Advanced Options

You can also configure:

• Groups: Create email groups for easier management
• Service tokens: For programmatic access
• Country restrictions: Allow only specific countries
• IP restrictions: Allow only specific IP ranges
• Device posture: Require specific device checks

See docs/CLOUDFLARE_ACCESS_SETUP.md for more details.

Verification

After configuring, test access:

1. Open https://ml110-01.d-bis.org in an incognito window
2. You should see Cloudflare Access login
3. Login with an allowed email
4. You should be granted access

If you use a non-allowed email, access will be denied.