# Demo 6: Internal-only access

**Port:** 3006 (admin toggle) · **Services:** Cloudflare Access (Zero Trust)

## Demo moment

An admin page for the shift board that Nordwerk brought onto the platform (demo 8), with three options: **Public**, **Office network only**, **Company email**. Switching to "Office network only" makes the app open on the laptop (venue Wi-Fi) and blocked on a phone on mobile data. Switching to "Company email" shows a login page with a one-time PIN.

## Setup

- The protected app is the shift board deployed by [`demos/byoa`](../byoa); its hostname goes in `ACCESS_DEMO_HOSTNAME`. Until that exists, use your own small Worker on a `workers.dev` hostname serving a static page.
- Zero Trust enabled on the account, with the one-time PIN login method.
- From the terminal, use the `cf` CLI (this repo has no Wrangler configuration).

## Flow

The toggle calls the Cloudflare API from server code:

- **Public:** delete the Access application for the hostname (or leave none).
- **Office network only:** create or update a self-hosted Access application for `ACCESS_DEMO_HOSTNAME` (`POST /accounts/{account_id}/access/apps`) with a **Bypass** policy including the office IP range (`OFFICE_IP_CIDR`). Access denies everyone else by default. Bypass requests are not logged.
- **Company email:** the same application with an **Allow** policy including the email domain (`COMPANY_EMAIL_DOMAIN`); users see a login page and get a one-time PIN.

Find the venue's public IP on site and set `OFFICE_IP_CIDR` to it (`/32`).

## Env

`CLOUDFLARE_API_TOKEN` (Access: Apps and Policies Edit), `CLOUDFLARE_ACCOUNT_ID`, `ACCESS_DEMO_HOSTNAME`, `OFFICE_IP_CIDR`, `COMPANY_EMAIL_DOMAIN`

## Fallback

A screen recording of both modes on two devices.

## Done when

- Each toggle state takes effect within a minute.
- Both restricted modes are demonstrated on two devices.

## Out of scope

Per-business automation at scale, seat economics, WARP device checks, customers' own domains.