tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: add Use Case 12 for Hybrid Cloud Edge, Cloudflare Tunnel & Split-Horizon audit requirements

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-24 14:46:44 -07:00
parent b4b05c37ff
commit e9b9088fec
1 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
docs/USE_CASES_AND_EFFORT.md
View File

@ -32,6 +32,7 @@ operational and integration scenarios**.
│ 9 │ Multi-App RBAC & Scope Provisioning │ Low │ Simple Web UI Form │ │ 9 │ Multi-App RBAC & Scope Provisioning │ Low │ Simple Web UI Form │
│ 10 │ Cryptographic Compliance & Audit Verification │ Zero │ Automated Merkle Logs │ │ 10 │ Cryptographic Compliance & Audit Verification │ Zero │ Automated Merkle Logs │
│ 11 │ Ephemeral Guest Sandboxes & Open Trial Access │ Minimal │ 1-Click / Zero Passkey │ │ 11 │ Ephemeral Guest Sandboxes & Open Trial Access │ Minimal │ 1-Click / Zero Passkey │
│ 12 │ Hybrid Cloud Edge & Remote Tunnel Ingress │ Low │ Zero-Touch Tunnel / DoH│
└────┴─────────────────────────────────────────────────┴──────────────────┴────────────────────────┘ └────┴─────────────────────────────────────────────────┴──────────────────┴────────────────────────┘
``` ```
@ -285,3 +286,31 @@ operational and integration scenarios**.
- ForwardAuth transparently sets `X-Forwarded-Scopes: guest,trial` downstream. - ForwardAuth transparently sets `X-Forwarded-Scopes: guest,trial` downstream.
- Upgrades convert the ephemeral guest ID to a permanent passkey account - Upgrades convert the ephemeral guest ID to a permanent passkey account
seamlessly in memory. seamlessly in memory.
---
### Use Case 12: Hybrid Cloud Edge & Remote Tunnel Ingress (Cloudflare Tunnel, Split-Horizon DNS & WAN Resiliency)
- **Difficulty Level:** **Low (Zero-Touch Tunnel Ingress / Transparent
Split-Horizon)**
- **What you actually have to do:**
1. Map public hostnames in Cloudflare Zero Trust Tunnels (`cloudflared`)
pointing `auth.atyg.org` and downstream subdomains (e.g.
`ed-droid.atyg.org`) to internal Traefik (`http://192.168.1.10:80` or
`https://192.168.1.10:443` with "No TLS Verify").
2. Local LAN devices resolve directly to `192.168.1.10` via local router/DNS,
while remote mobile clients resolve via Cloudflare Anycast edge proxies.
3. Auth-Yes handles ForwardAuth 302 redirects and session cookie scoping
transparently across both local LAN and remote WAN ingress vectors.
- **Audit & Architectural Resilience Verification Requirements:**
- **Cookie Scope Parity:** Ensure `Set-Cookie` with wildcard domain
`.atyg.org` is preserved across reverse proxy tunnels without origin
truncation.
- **Open-Redirect & Deep-Link Preservation:** Verify
`https://auth.atyg.org/login?redirect=...` deep-links survive multi-hop
proxies and DoH mobile resolvers.
- **Negative DNS Caching & Mobile DoH Isolation:** Validate system behavior
when client mobile OS resolvers transition between Wi-Fi split-horizon DNS
and cellular DNS over HTTPS (DoH).
- **Latency SLA:** Verify ForwardAuth edge lookup latency remains $<50\mu s$
on internal LAN and $<10$ms over Cloudflare Tunnel edge.