dsh-cloudflare-access

Cloudflare Access configuration

1. Put the DSH Web origin behind a Cloudflare Access application.
2. Copy the application Audience (aud) and your team domain, for example https://example.cloudflareaccess.com.
3. Cloudflare injects Cf-Access-Jwt-Assertion on authenticated requests. The plugin verifies that header only. It does not trust the CF_Authorization cookie.

Issuer and JWKS URL are derived:

issuer  = teamDomain
JWKS    = /cdn-cgi/access/certs

You do not configure issuer or jwksUrl separately. Multiple audiences are supported.

DSH configuration

Pin team domain and audiences with environment variables in production. Env locks the trust root so a remote Settings session cannot retarget another Cloudflare team.

dsh --profile web --trusted-host dsh.example.com

Variable	Meaning
DSH_CF_ACCESS_TEAM_DOMAIN	Team domain / issuer
DSH_CF_ACCESS_AUDIENCES	Comma-separated audiences
DSH_CF_ACCESS_ORDINARY_MODE	off | optional | required

If a variable exists, even as an empty string, that field is locked. Environment variables override Cordis / bundle config.

Cordis overlay (only used when the matching env var is unset):

cloudflare:
  teamDomain: https://example.cloudflareaccess.com
  audiences:
    - xxxxxxxxxxxxxxxxx
auth:
  ordinary: off

Missing teamDomain or audiences: the plugin still starts, loopback is unchanged, remote privileged APIs are denied.