Engineering docs — access & security
Why access is enforced outside Docusaurus
Docusaurus only builds static files and has no authentication of its own; access control belongs to the hosting layer (Docusaurus issue #2769, deployment docs).
Target control: Cloudflare Access
Access checks every request at the Cloudflare edge before the Worker runs; unapproved visitors see a login page and receive no content (Workers + Access).
| Setting | Value |
|---|---|
| Protected application | Worker engineering-docs (all traffic — every route and URL of the Worker) |
| Policy | Allow emails ending in the TTG domain + named individuals |
| Login methods | One-time PIN (email); Google can be added |
| Plan | Zero Trust Free — up to 50 users |
Billing safety (Zero Trust Free)
- When all 50 seats are used, additional users are blocked, not charged (Seat management).
- A seat is consumed by an authentication event; removing a user frees the seat.
- Charges only start if someone deliberately upgrades the plan — keep billing/Super Administrator rights to one or two TTG people, keep the policy narrow, remove leavers.
Alternatives considered
| Option | Verdict |
|---|---|
| WAF custom rule (IP allowlist) — Free plan, 5 rules | Good interim or additional layer; brittle with changing home IPs |
| Google sign-in implemented in the Worker | Free, per-person SSO; own code to maintain and test |
| HTTP Basic Auth in the Worker | Shared password, no per-person revocation — not recommended |
| GitHub Pages private / Vercel / Netlify / hosted doc platforms | Paid tiers or leaving Docusaurus |
Content rules
- No secret values ever (tokens, passwords, keys) — name the secret and where it lives.
- Account identifiers and open security findings are published only while Access protects the site.