Validate Cloudflare Access enforcement for public tunnel routes

[alucero270]

Context

The Cloudflare Tunnel documentation is present for Prometheus, including sanitized /etc/cloudflared/config.yml and /opt/traefik/dynamic/loosearrow-public.yml references.

A remaining validation gap is documented in systems/prometheus/opt/stacks/ingress/cloudflare-tunnel/cloudflare-tunnel.md: Access gate enforcement needs validation before adding public Canonis exposure. The doc notes that external curl probes on 2026-05-31 returned HTTP 200 for existing public routes, so the expected Cloudflare Access challenge was not proven from that workstation.

Validation Target

Confirm that public Cloudflare Tunnel routes are protected by Cloudflare Access before any Canonis public exposure is enabled.

Success Criteria

• From an unauthenticated browser/session, each public route redirects to Cloudflare Access or returns an Access-controlled denial.
• After authenticating as the owner email, expected routes load.
• canonis.loosearrowlabs.com remains disabled/deferred until Access enforcement is proven and documented.
• Update the Cloudflare Tunnel service doc and validation checklist with dated results.

References

• systems/prometheus/opt/stacks/ingress/cloudflare-tunnel/cloudflare-tunnel.md
• systems/prometheus/opt/stacks/ingress/cloudflare-tunnel/procedures/cloudflare-tunnel-validation.md
• systems/prometheus/opt/stacks/canonis/canonis.md

[alucero270]

Validation attempted from this workstation on 2026-06-06 using unauthenticated external HTTPS HEAD probes.

Results:

• https://chat.loosearrowlabs.com/ returned HTTP 200.
• https://search.loosearrowlabs.com/ returned HTTP 200.
• https://comfy.loosearrowlabs.com/ returned Cloudflare HTTP 502.
• https://canonis.loosearrowlabs.com/ returned HTTP 404.

Conclusion: Cloudflare Access enforcement is not proven and appears missing/misconfigured for at least the existing public routes that returned HTTP 200 directly. This fails the issue success criteria. Canonis public access remains deferred; do not treat canonis.loosearrowlabs.com as approved public exposure.

Docs updated with the dated failed validation:

• systems/prometheus/opt/stacks/ingress/cloudflare-tunnel/cloudflare-tunnel.md
• systems/prometheus/opt/stacks/ingress/cloudflare-tunnel/procedures/cloudflare-tunnel-validation.md
• systems/prometheus/opt/stacks/canonis/canonis.md

Next safe action: create or repair Cloudflare Access applications/policies for every public hostname in the Cloudflare dashboard/API, then rerun the unauthenticated probe plus an authenticated owner-browser validation.