Repository navigation
Access to Cloudflare #3220
Description
Requesting access to Cloudflare, as I would like to be around to support with times the cache for Nodejs.org becomes havoc, and also for the incoming changes we're going to do with nodejs.dev, nodejs.org, vercel, etc
cc @nodejs/build
Activity
ovflowd commentedon Mar 16, 2023
Note.: The kind of access I'm requesting (because of CF ACLs) is to have enough "power/authorisation" to do these actions:
In general, these privileges would also be helpful for the incoming Vercel work.
tniessen commentedon Mar 17, 2023
If the number of people with access to CF grows, we should probably start making use of CF "members" so that we can manage access in more detail. Right now we just use a single set of credentials (with 2FA) as far as I know.
nschonni commentedon Mar 17, 2023
Might make sense to look at something like https://developers.cloudflare.com/terraform/ to pull the actual config changes into this repo. I didn't see any first party Ansible tasks with a very quick search
mhdawson commentedon Mar 17, 2023
@nschonni the terraform suggestion looks interesting. That would address one concern related to growing the number of people with cloudflare access.
MattIPv4 commentedon Mar 17, 2023
+1 to having the Cloudflare config defined in terraform in the repo. Would make it much easier for folks to understand what's currently configured and propose edits etc.
UlisesGascon commentedon Mar 18, 2023
+1 to manage Cloudflare using Terraform, also I agree to provide access to Cloudflare for @ovflowd as some tasks will require it like the Monitor/Analysis of Traffic.
UlisesGascon commentedon Apr 11, 2023
@ovflowd we agreed in #3299 that we will grant you access, but first we will need to change the way we access to Cloudflare from a single account to an individual accounts (organization approach).
ovflowd commentedon Apr 11, 2023
Thanks for the update!
richardlau commentedon May 18, 2023
I've just invited myself to the build account (which has resulted in a confirmation to the build email address FYI @nodejs/build-infra ). For people in the build-infra team, who already have access to the existing build account, I'm comfortable giving their individual accounts "Super Administrator" which should mean they would not normally need to log in directly as the build account.
For anyone outside of the build-infra team we'd need to work out which of the account-scoped roles we would want to grant
Refs: https://developers.cloudflare.com/fundamentals/account-and-billing/members/roles/#account-scoped-roles
targos commentedon Jul 10, 2023
I've tried to add myself to the account but I get:
Note that I do have 2FA enabled.
I opened a support ticket.
ovflowd commentedon Jul 11, 2023
Got access so closing this :)