Skip to content
MementropyKnowledge
GitHub
DocsKnowledge base

Protect Admin With Cloudflare Access

Protect Mementropy's standalone Admin Pages project across its custom domain, production hostname, and previews.

Architecture

Admin is a separate, whole-host protected application.

The public site builds from the repository root and serves mementropy.com. Admin builds independently from apps/admin/ and serves admin.mementropy.com. The public build contains no Admin pages.

Protected surfaces

Section titled “Protected surfaces”

Cloudflare Pages exposes three classes of Admin hostname, and each requires an Access application:

Access application Destination Purpose
admin admin.mementropy.com Canonical Admin URL
mementropy-admin production mementropy-admin.pages.dev Production Pages hostname
mementropy-admin - Cloudflare Pages *.mementropy-admin.pages.dev Hash and branch previews

The separate mementropy - Cloudflare Pages application belongs to the public site’s Pages project. It is not a duplicate Admin application.

1. Confirm the publishing boundary

Section titled “1. Confirm the publishing boundary”

Before adding private material, confirm all of the following:

  • The GitHub repository is private. Access protects deployed requests, not source files committed to GitHub.
  • Admin content lives under apps/admin/src/content/docs/, never under the public application’s src/content/docs/ tree.
  • Private attachments live under apps/admin/public/. Root-relative links such as /attachments/example.pdf remain on the protected Admin host.
  • The Admin build keeps Pagefind disabled, serves robots.txt with Disallow: /, and applies no-index/no-store headers to /*.
  • Credentials, API keys, and reusable secrets are never committed, even to a private repository.

2. Protect the custom domain

Section titled “2. Protect the custom domain”
  1. In Cloudflare, go to Zero Trust → Access controls → Applications.
  2. Create a Self-hosted and private application.
  3. Name it admin.
  4. Add the public hostname admin.mementropy.com with no path restriction.
  5. Add an Allow policy with Include → Emails set to each exact approved address. Do not use Everyone or an email-domain-wide rule.
  6. Select the intended identity provider and save.

3. Protect preview deployments

Section titled “3. Protect preview deployments”
  1. Go to Workers & Pages → mementropy-admin → Settings → General.
  2. Under Preview access, select Manage. If Access has not been enabled yet, the same control may instead say Enable access policy.
  3. Confirm that Zero Trust creates mementropy-admin - Cloudflare Pages for *.mementropy-admin.pages.dev.
  4. Open its Allow policy and confirm Include → Emails contains only the exact approved address or addresses.

4. Protect the production Pages hostname

Section titled “4. Protect the production Pages hostname”

Cloudflare’s preview switch does not protect mementropy-admin.pages.dev. Use Cloudflare’s documented Pages procedure to give the production hostname its own application:

  1. Open the preview Access application and edit All Destinations.
  2. Remove * from the Subdomain field so the destination becomes exactly mementropy-admin.pages.dev.
  3. Rename the application to mementropy-admin production and save.
  4. Return to Workers & Pages → mementropy-admin → Settings → General → Preview access, select Manage, and re-enable the preview access policy. This recreates the wildcard preview application alongside the production application.
  5. Confirm both applications use an exact-email Allow policy.

The Admin setup intentionally has three Access applications. The production Pages hostname and wildcard previews cannot be represented by the same auto-managed Pages destination.

5. Verify before publishing private content

Section titled “5. Verify before publishing private content”

Use a logged-out private browser window:

  • https://admin.mementropy.com/ shows the Cloudflare Access sign-in page.
  • https://mementropy-admin.pages.dev/ shows the Access sign-in page.
  • A current hash or branch preview under *.mementropy-admin.pages.dev shows the Access sign-in page.
  • A disallowed email cannot enter any of those destinations.

Then sign in with an approved account and verify:

  • /, /recipes/, and /planning/ load on the custom domain.
  • The production pages.dev hostname loads the same Admin application.
  • A current preview loads only after authentication.
  • https://mementropy.com/, /academy/, /blog/, /whitepapers/, and /docs/ remain public.
  • Legacy https://mementropy.com/admin/... URLs redirect to the equivalent route on admin.mementropy.com.

Build boundary

The public build must contain no dist/admin/ tree and no internal /admin links.

Identity boundary

Every Admin Access application must include exact approved email addresses only.

Official Cloudflare references

Section titled “Official Cloudflare references”