From e9b9088fec2ed84810a401fb2829b8f19645f19d Mon Sep 17 00:00:00 2001 From: Tyler Gillispie Date: Mon, 24 Aug 2026 14:46:44 -0700 Subject: [PATCH] docs: add Use Case 12 for Hybrid Cloud Edge, Cloudflare Tunnel & Split-Horizon audit requirements --- docs/USE_CASES_AND_EFFORT.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/docs/USE_CASES_AND_EFFORT.md b/docs/USE_CASES_AND_EFFORT.md index 579f5d2..a79d069 100644 --- a/docs/USE_CASES_AND_EFFORT.md +++ b/docs/USE_CASES_AND_EFFORT.md @@ -32,6 +32,7 @@ operational and integration scenarios**. │ 9 │ Multi-App RBAC & Scope Provisioning │ Low │ Simple Web UI Form │ │ 10 │ Cryptographic Compliance & Audit Verification │ Zero │ Automated Merkle Logs │ │ 11 │ Ephemeral Guest Sandboxes & Open Trial Access │ Minimal │ 1-Click / Zero Passkey │ +│ 12 │ Hybrid Cloud Edge & Remote Tunnel Ingress │ Low │ Zero-Touch Tunnel / DoH│ └────┴─────────────────────────────────────────────────┴──────────────────┴────────────────────────┘ ``` @@ -285,3 +286,31 @@ operational and integration scenarios**. - ForwardAuth transparently sets `X-Forwarded-Scopes: guest,trial` downstream. - Upgrades convert the ephemeral guest ID to a permanent passkey account seamlessly in memory. + +--- + +### Use Case 12: Hybrid Cloud Edge & Remote Tunnel Ingress (Cloudflare Tunnel, Split-Horizon DNS & WAN Resiliency) + +- **Difficulty Level:** **Low (Zero-Touch Tunnel Ingress / Transparent + Split-Horizon)** +- **What you actually have to do:** + 1. Map public hostnames in Cloudflare Zero Trust Tunnels (`cloudflared`) + pointing `auth.atyg.org` and downstream subdomains (e.g. + `ed-droid.atyg.org`) to internal Traefik (`http://192.168.1.10:80` or + `https://192.168.1.10:443` with "No TLS Verify"). + 2. Local LAN devices resolve directly to `192.168.1.10` via local router/DNS, + while remote mobile clients resolve via Cloudflare Anycast edge proxies. + 3. Auth-Yes handles ForwardAuth 302 redirects and session cookie scoping + transparently across both local LAN and remote WAN ingress vectors. +- **Audit & Architectural Resilience Verification Requirements:** + - **Cookie Scope Parity:** Ensure `Set-Cookie` with wildcard domain + `.atyg.org` is preserved across reverse proxy tunnels without origin + truncation. + - **Open-Redirect & Deep-Link Preservation:** Verify + `https://auth.atyg.org/login?redirect=...` deep-links survive multi-hop + proxies and DoH mobile resolvers. + - **Negative DNS Caching & Mobile DoH Isolation:** Validate system behavior + when client mobile OS resolvers transition between Wi-Fi split-horizon DNS + and cellular DNS over HTTPS (DoH). + - **Latency SLA:** Verify ForwardAuth edge lookup latency remains $<50\mu s$ + on internal LAN and $<10$ms over Cloudflare Tunnel edge.