Skip to content

Provider console (admin site)

TotlProvision has two front-ends that share one Worker API:

Site Host Who Auth
Customer portal (portal/) totlprovision.totlcom.com a customer's own admins/engineers Cloudflare Access (internal) or OIDC (public)
Provider console (admin/) admin.totlprovision.totlcom.com Totlcom staff running the platform Cloudflare Access, restricted to staff

Splitting them keeps the cross-tenant management surface off the customer-facing host. A customer never sees the provider console; a bug or misconfig on the portal can't expose all-customer data.

What the provider console does

  • Fleet overview — total customers, machines, active seats, and how many customers are over their seat limit.
  • Customer CRUD — create and delete customers (tenants).
  • Per-customer summary — open any customer to see its machines, builds, SSO mappings, and set its seat limit. A link jumps to the customer portal for deeper per-tenant work (secrets, break-glass).
  • Billing CSV — export machines / active seats / seat limit / over-limit across every customer.

It only calls endpoints the Worker already exposes to a provider role (cross-tenant via ?tenant=), so there is no separate admin API to maintain. A non-provider who reaches the host sees an access notice.

Deploy

# From repo root — a separate Pages project + host:
wrangler pages deploy admin --project-name totlprovision-admin

Then in Cloudflare:

  1. Add a custom domain admin.totlprovision.totlcom.com to the totlprovision-admin Pages project.
  2. Add a Cloudflare Access application for that hostname, policy = Totlcom staff only.
  3. The Worker route admin.totlprovision.totlcom.com/api/* (in backend/wrangler.toml) is already wired, so the console reaches the API same-origin with the Access session attached.

Security

  • The console never holds tenant decryption keys — secret reveal / break-glass stay in the customer portal, where the passphrase is entered client-side.
  • Cross-tenant reads and management are gated server-side by the provider capability (canManageTenant), not by which site made the request — so the split is defense-in-depth, not the only control.