Disclaimer: This document serves as an architectural specification and technical guide. Actual implementation requires adherence to organizational security policies, proper secret management (e.g., HashiCorp Vault), and rigorous testing in a staging environment.
Cloudflare Zero Trust Integration Specification for Sleeper Endpoints
Document Version: 1.0
Date: October 2024
Scope: Implementation of granular access control, authentication validation, and secure communication channels across all designated project4 endpoints using the Cloudflare Zero Trust platform.
I. Architectural Overview: The Zero Trust Model
The integration shifts the security posture from perimeter-based defense to an identity-aware, least-privilege model. All requests, regardless of origin (internal network, external internet, or machine-to-machine), must be authenticated and authorized against defined policies before reaching the application layer.
Key Components:
- Cloudflare Access: Handles user authentication and policy enforcement at the edge.
- Identity Provider (IdP): (e.g., Okta, Azure AD) Used for centralized user identity verification.
- WAF/Rate Limiting: Provides defense against common web exploits and abuse.
II. Access Policies (Cloudflare Access Application Rules)
Access policies must be defined within the Cloudflare Zero Trust dashboard under "Applications" and linked to specific Identity Provider groups.
A. Endpoint: body.project4.net (Primary User Interface)
This endpoint requires high-assurance authentication, typically for human users accessing core application features.
| Policy Component | Requirement/Rule Set | Enforcement Mechanism | Notes |
|---|---|---|---|
| Target Audience | Employees belonging to the project4-users group. | IdP Group Mapping | Must be scoped to specific organizational units (OUs). |
| Authentication Method | Multi-Factor Authentication (MFA) required for all sessions. | Conditional Access Policy | Enforce TOTP or hardware key authentication. |
| Source Restriction | Geo-fencing restricted to approved corporate regions (e.g., US, EU). | Cloudflare IP/Geo Rules | Block traffic originating from high-risk or unapproved geographies. |
| Session Duration | Maximum session timeout of 8 hours; re-authentication required after inactivity exceeding 30 minutes. | Access Policy Settings | Improves security by limiting the window for credential theft exploitation. |
B. Endpoint: internal-docs.project4.net (Internal Documentation Portal)
This endpoint is intended for internal knowledge sharing and requires a slightly lower, but still mandatory, level of access control compared to the primary application.
| Policy Component | Requirement/Rule Set | Enforcement Mechanism | Notes |
|---|---|---|---|
| Target Audience | Employees belonging to the project4-internal group. | IdP Group Mapping | Access is restricted solely to employees who have passed onboarding and are active within the company. |
| Authentication Method | MFA required, but may allow fallback to passwordless SSO if deemed necessary by security operations. | Conditional Access Policy | The primary goal is verification of identity, not necessarily high-assurance session control. |
| Source Restriction | Optional: Restrict access only from known corporate IP ranges (VPN/Office). | Cloudflare IP Rules | If the documentation is highly sensitive, restrict to internal network egress points. |
III. Application Layer Validation (PHP / Node.js Backend)
To ensure that requests have successfully passed through the Zero Trust enforcement layer and