Cloudflare: --auth login and token via Cloudflare Access; default public provider Cloudflare

[longzhi]

What

• --via cloudflare --auth login --allow a@x.com,b@y.com: creates a Cloudflare Access self-hosted app omarchy-remote:<name>:login, guarded by a reusable policy omarchy-remote:<name> that allows those emails. Login uses an email one-time code (allowed_idps = the account's one-time PIN method, auto_redirect_to_identity). If the Zero Trust org doesn't have one-time PIN yet, it is added.
• --via cloudflare --auth token: creates an Access service token omarchy-remote:<name> and a non_identity (Service Auth) policy. Clients send CF-Access-Client-Id / CF-Access-Client-Secret.
• The Access app is created before the DNS record, so the hostname is never reachable without auth. expose waits for a credential-less 302/401/403 before it reports success.
• unexpose and rollback delete the app, then the policy, then the service token. When the token has no Access permissions (bearer-only setups), these steps are skipped quietly.
• --auth password on Cloudflare is refused with a hint: a WAF block can't send WWW-Authenticate, so browsers would never see a prompt.
• Default public provider changes from Pangolin to Cloudflare, or Pangolin if only Pangolin is set up on the machine. password picks Pangolin and bearer picks Cloudflare. An explicit config set public still wins.
• Fix: the rollback traps referenced $fqdn after errexit had unwound the function's locals (fqdn: unbound variable), so a failed expose aborted its own rollback. This affected Pangolin and Cloudflare bearer too.
• Docs (README en/zh, CLAUDE.md), 0.6.0.

Testing

• shellcheck install.sh bin/omarchy-remote is clean.
• Not tested against a live Zero Trust org. The only Cloudflare account available has a production Zero Trust org that we must not change. Request shapes follow the API reference (reusable policies POST /access/policies, apps with policy links {id, precedence}, service tokens, identity providers type: onetimepin).
• Ran 13 cases against a stateful fake of the Cloudflare API, DoH and the edge:
  • login and token: expose, list, unexpose;
  • the one-time PIN method is reused across services;
  • rollback when the app POST fails and when the policy POST fails: no leftovers;
  • Zero Trust missing: clear error, rollback;
  • argument validation: login without --allow, password on Cloudflare;
  • default provider selection.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.