CLOUDFLARE
Log In to Cloudflare Access¶
Use this procedure whenever you need to view a NetWise resource protected by Cloudflare Access — currently the NetWise Wiki itself, at operations.netwiseuk.com.
Two identity providers are configured: GitHub and Cloudflare. Sign in with GitHub — it's reliable and avoids the emailed one-time PIN problems described under Troubleshooting below.
Cloudflare Access is separate from editing the Wiki's content. See Editing the Wiki's content below for that.
1. Open the protected address¶
Go to the protected address in your browser — for example https://operations.netwiseuk.com.
Cloudflare Access intercepts the request and shows a sign-in screen before you reach the site.
2. Choose GitHub¶
The sign-in screen offers a choice of identity providers. Choose GitHub.
3. Authorise with GitHub¶
Sign in to GitHub if you're not already, and authorise the NetWise Internal Wiki application if prompted.
4. Confirm you're signed in¶
You should be returned to the protected site's actual content.
Other sign-in methods¶
Cloudflare¶
The sign-in screen also offers Cloudflare as an identity provider. This is restricted to Cloudflare account members and was tested successfully with steve@netwiseuk.com.
Email one-time PIN¶
Cloudflare Access can also fall back to emailing a one-time PIN. This method hasn't been deliberately removed, but it's known to be unreliable — see Troubleshooting. Prefer GitHub or Cloudflare sign-in instead.
Troubleshooting¶
"This One-Time Pin has already been used"¶
This affects the email one-time PIN method, and specifically appears when entering the numeric code manually rather than clicking the link in the email.
What's confirmed: clicking the link in the email works reliably; manually copying and entering the numeric code is the failure mode.
The exact cause isn't confirmed. Don't treat any single explanation below as certain — Cloudflare's own documentation notes that email security and link-scanning tools can consume a single-use authentication link automatically, which is one possible cause of this class of problem. Other plausible contributing factors:
- Requesting more than one code — each new code invalidates the previous one, so an older email's code fails even if you never used it.
- More than one browser tab or device with a sign-in attempt in progress for the same address.
- Autofill (particularly on iOS/macOS) inserting an old code from a previous email instead of the one just copied.
Rather than debugging this further, use GitHub or Cloudflare sign-in instead — both avoid the one-time PIN entirely.
Final check¶
You know sign-in has succeeded when the protected site's actual content loads instead of the Cloudflare Access sign-in screen.
Session length¶
A successful sign-in lasts 24 hours before you need to sign in again.
Who can sign in¶
Cloudflare Access is restricted per application by an allow-list of specific email addresses, independent of which identity provider is used to authenticate. For the NetWise Wiki (operations.netwiseuk.com), the allowed addresses are steve@netwiseuk.com and adam@netwiseuk.com.
This allow-list is managed in Cloudflare under Zero Trust → Access → Applications → NetWise Ops Wiki.
Applications currently requires Zero Trust plan onboarding
Opening Access controls → Applications in Cloudflare Zero Trust can prompt for Zero Trust plan onboarding and payment details, even on the free plan. Don't provide payment details to get past this unless a plan change is actually intended. Because of this, the Access application's allow-list itself was not opened or altered when the identity providers below were added — only the identity providers were configured.
How the identity providers are configured¶
This is a reference record of the current setup, for anyone maintaining it later. It's not something you need to repeat to sign in.
Both identity providers are configured in Cloudflare under Zero Trust → Integrations → Identity providers.
Cloudflare Zero Trust team name: netwiseuk. Team domain: netwiseuk.cloudflareaccess.com.
Cloudflare¶
Added as an identity provider with Restrict to account members enabled, so only members of the NetWise Cloudflare account can authenticate through it. Tested successfully with steve@netwiseuk.com.
GitHub¶
Uses a dedicated GitHub OAuth App called NetWise Internal Wiki, with:
- Homepage URL:
https://netwiseuk.cloudflareaccess.com(the Cloudflare team domain — the app initially had the wrong homepage URL, which had to be corrected to this before Cloudflare's Finish setup step would complete). - Authorization callback URL:
https://netwiseuk.cloudflareaccess.com/cdn-cgi/access/callback. - Wildcard matching: not enabled.
- Device Flow: not enabled.
The OAuth App's Client ID and generated client secret were entered into Cloudflare's GitHub identity provider configuration. The client secret itself is deliberately not recorded here or anywhere in the Wiki.
Both identity providers were tested successfully before being relied on.
Editing the Wiki's content (a different system)¶
Signing in through Cloudflare Access — by any method above, including GitHub — only lets you read the published Wiki. It is not the same thing as GitHub access to the Wiki's source.
Editing content is a separate, unrelated system: the Wiki's source is the private GitHub repository NetWise-UK/netwise-wiki, and Cloudflare Pages rebuilds and republishes it automatically whenever main is pushed to.
To edit content you need GitHub access to that repository. Steve and Adam are both admins of the NetWise-UK GitHub organisation, which already gives both of them full access to the repository — no separate invitation is needed between the two of them.
See CONTRIBUTING.md in the repository for how content changes are actually made.