Skip to main content

Protect apps with Cloudflare Access

Add an access: block to any app to protect it with Cloudflare Access. Moley creates the Access Application automatically and tears it down on stop.

Basic Example​

moley.yml
ingress:
  zone: "yourdomain.com"
  mode: subdomain
  apps:
    - target:
        port: 3000
        hostname: "localhost"
        protocol: http
      expose:
        subdomain: "app"
      access:
        providers:
          - github
        session_duration: "24h"

Identity Providers​

The providers list accepts Cloudflare IdP type names (e.g. github, google-workspace). Moley matches these against the IdPs configured in your account and resolves them to UUIDs. See Cloudflare identity provider integration for available types and setup.

Cloudflare API Passthrough​

All fields under access: (other than providers) are forwarded to the Cloudflare Access API as-is. See the Cloudflare self-hosted app configuration for all available fields.

Attaching Policies​

Reference named policies from access.policies by name:

ingress:
  apps:
    - expose:
        subdomain: "app"
      access:
        providers:
          - github
      policies:
        - team-only    # references access.policies[name=team-only]